If there is a "Login from Unexpected Country" escalation, there should be a secondary check to see if there is a Huntress agent registered to the same client located at that same IP.

If there is an agent registered to the same account at that IP, we can be reasonably sure that the login is expected.