[AZURE-EVENTHUB-AD] unknownFutureValue Event Detected

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[AZURE-EVENTHUB-AD] unknownFutureValue Event Detected"; program: azureEventHub; json_content:".properties.riskState","unknownFutureValue"; json_contains; json_map: "src_ip", ".callerIpAddress"; json_map: "dest_ip", ".callerIpAddress"; json_map: "username", ".properties.userPrincipalName"; classtype: bad-unknown; reference:url,docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-azure-monitor-sign-ins-log-schema; sid:5004772; rev: 4;)