Azure Suspicious Login Failures [splunk-azure]

`get_cloud_data` `get_cloud_data_azure` (TERM(SignInLogs) 
OR TERM(NonInteractiveUserSignInLogs)) resultType IN("50126", "50053" , "50055", "50056")
| eval login_state='properties.location.state', login_region='properties.location.countryOrRegion', failure_reason=resultDescription
| table _time, host, user,account, region, src_ip, http_user_agent, access_key, user, user_id, identity_type, role, event_name, event_category, cloud_service, request_parameters, response, mfa_enabled, permissions, identity, action, resource_id, object_id, login_*, failure_reason `group_events("user",10min)`
| eventstats dc(login_state) as dc_login_state by user
| eventstats dc(login_region) as dc_login_region by user
| eventstats dc(src_ip) as dc_src_ip by user
| where dc_login_state > 1 
OR dc_login_region > 1 
OR dc_src_ip > 1 
OR event_count > 1