Your question is SIEM Rule for Unusual Login. Take a moment with it on the right.
Talk me through your thinking if you like. When you're confident, submit your answer and I'll grade it like a real screen (7/10 or better passes).
Design a SIEM detection rule for an unusual login pattern.
Use Google Security Operations, Cloud Identity, and relevant authentication telemetry. Define the detection logic, required fields, thresholds, alert severity, false-positive handling, and validation approach. Explain how the rule supports investigation and response without relying on a single signal.
