So... You set up a splunk alert to tell you if someone successfully logs in from two regions within X hours. You get alerted. Best followup?