Goal

Detect whenever a user uses an application from a new country.

Strategy

This rule monitors the user’s HTTP Client IP location to detect when the application is accessed from a country that has not been seen before.

Triage & response

Investigate user with id {{@usr.id}} for unusual activity (account theft…).