✄𐘗
text code block:
✄𐘗from logs-openai_chatgpt_enterprise.*
| where
    user.email is not null and
    source.ip is not null and
    source.geo.country_iso_code is not null
| stats
    Esql.country_count = count_distinct(source.geo.country_iso_code),
    Esql.region_count = count_distinct(source.geo.region_name),
    Esql.source_ip_count = count_distinct(source.ip),
    Esql.user_agent_count = count_distinct(user_agent.original),
    Esql.event_count = count(*),
    Esql.event_action_values = values(event.action),
    Esql.source_ip_values = values(source.ip),
    Esql.source_geo_country_iso_code_values = values(source.geo.country_iso_code),
    Esql.source_geo_region_name_values = values(source.geo.region_name),
    Esql.source_geo_city_name_values = values(source.geo.city_name),
    Esql.user_agent_original_values = values(user_agent.original),
    Esql.timestamp_first_seen = min(@timestamp),
    Esql.timestamp_last_seen = max(@timestamp)
  by user.email
| where Esql.country_count >= 3 and Esql.user_agent_count >= 2
| keep user.email, Esql.*