Untitled

index=eulen_azure sourcetype="azure:aad:signin"
| spath path=location.countryOrRegion output=country_code
| search country_code IN ("RU", "CN", "IR", "KP", "SY", "CU", "BY", "VE", "AF", "PK", "SD", "UA", "TR", "NG", "VN", "IN")
| eval country_name=case(
    country_code=="RU", "Rusia",
    country_code=="CN", "China",
    country_code=="IR", "Irán",
    country_code=="KP", "Corea del Norte",
    country_code=="SY", "Siria",
    country_code=="CU", "Cuba",
    country_code=="BY", "Bielorrusia",
    country_code=="VE", "Venezuela",
    country_code=="AF", "Afganistán",
    country_code=="PK", "Pakistán",
    country_code=="SD", "Sudán",
    country_code=="UA", "Ucrania",
    country_code=="TR", "Turquía",
    country_code=="NG", "Nigeria",
    country_code=="VN", "Vietnam",
    country_code=="IN", "India",
    1==1, country_code
)
| stats first(_time) AS fecha values(action), values(reason), values(app), values(country_code), values(country_name), values(alert_id) count by userPrincipalName, ipAddress
| convert ctime(fecha) AS fecha
| eval fecha=strftime(strptime(fecha, "%m/%d/%Y %H:%M:%S"), "%d/%m/%Y %H:%M:%S")
| rename values(*) AS * 
| lookup vip_users.csv userPrincipalName OUTPUT userPrincipalName as vip_match
| eval VIP=if(isnull(vip_match),"No","Si")
| eval alert_id=md5(fecha.userPrincipalName.VIP.country_code)