This article explains how to generate a report showing all users who have successfully authenticated from outside a specific country, such as the United States of America (USA).

• Administration
• Reports
• System Log

1. Go to Reports > System Log.
2. Set the From and To Date and Time values.

3. Search for the following: 

   eventType eq "user.session.start" and client.geographicalContext.country ne "United States" and outcome.result eq "SUCCESS"

NOTE: To exclude a different country from the report, modify the value for client.geographicalContext.country in the search query.

4. Click Download CSV.
5. Open the downloaded Comma-Separated Values (CSV) file in a spreadsheet application.

6. To create a final list, remove duplicate entries based on the relevant columns, such as:

   • actor.alternate_id

   • client.geographical_context.country

   • client.geographical_context.city

   • request.ip_chain.geographical_context.geolocation.state

Related References

• How to Identify All Successfully Logged In User's Locations