Update AnomalousUserAppSigninLocationIncrease-detection.yaml

[TheAlistairRoss]

Required items, please complete

Change(s):

• Fixed the KQL logic in Update AnomalousUserAppSigninLocationIncrease-detection.yaml

Reason for Change(s):

• Provided a let variable to adjust the dcount accuracy argument with ease.
• Also set the "| where TimeGenerated" to use a between operator. When looking at the events from incidents within Sentinel (By selecting "Link to LA"), the query is evaluating logs from the 7 days preceding the original analytic rule run datetime to the current day, resulting in inaccurate representation of the events at that given time.

Version Updated:

• Yes

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• Yes

---