During a proactive hunt in Google SecOps, you hypothesize that an adversary is using valid credentials from an unusual location to access a set of internal admin consoles. You want to identify successful authentication events where the source geolocation country has almost never been seen for that specific user account over the past 90 days, so you can prioritize a small number of anomalous logins for investigation. Which UDM search approach best supports this hypothesis-driven hunt?