@tag-osrour - I have not use MLTK to implement this, but I've used regular Splunk lookup to implement what you need. You need two scheduled searches: Scheduled Report to generate Usual Country activities | tstats count, values(Authentication.org_country) as org_country from datamodel=Authentication where AND Authentication.user!="unknown" by Authentication.app, Authentication.user, Authentication.src, _time span=1d
| `drop_dm_object_name(Authentication)`
| iplocation src
| eval Country = if(isnotnull(org_country), org_country, Country)
| inputlookup authentication_usual_location.csv append=true
| where _time > relative_time(now(), "-12w@w")
| dedup user, app, Country, _time
| outputlookup authentication_usual_location.csv Scheduled Alert to alert when user's login is from an unusual country | tstats count from datamodel=Authentication by Authentication.app, Authentication.action, Authentication.user, Authentication.src, Authentication.dest, _time
| `drop_dm_object_name(Authentication)`
| eval user = lower(user)
| iplocation src
| inputlookup authentication_usual_location.csv append=true
| fillnull value=0 percentage_login_from_country
| where percentage_login_from_country < 15
| eval reason = case(isnull(usual_login_location), "No login from this user", percentage_login_from_country=="0", "No login from this country", true(), "Low historical login from this country")
| table _time user dest src app count City Region Country percentage_login_from_country reason usual_login_location These are not full queries, but they give idea on how you can implement it in your environment with your data with Splunk lookups. I hope this helps!!! Kindly upvote if it does.
... View more
