The system can detect some __________ events in real-time but other __________ events require more time to analyze pattern and behavior, such as __________ events arising from impossible travel to atypical locations. The systems needs time to be able to distinguish between a sign-in based on a __________'s regular behavior and an atypical sign-in. If the locations are geographically distant and the time delay between the sign-ins is insufficient for that __________ to have attempted to sign in from one location and then the other, that is an indication that the account has likely been compromised and a different __________ is using the __________'s credentials. When the system detects a __________ event for a __________ that hasn't been resolved it is considered an active __________ event. A __________ __________ is any active __________ event associated with a particular __________. Azure AD calculates the probability that a __________ has been compromised and assigns a __________ __________ level of low, medium, or high.