Hi guys, from the correlation "Suspicious - User Logon from Multiple Geolocations" I would like to obtain trigger for distinct countries. Instead I get the trigger for distinct cities. Is there a way to create a correlation for distinct countries?
Thank you