How would you answer an interview scenario involving security logging and threat detection in Cloud Security?

A privileged identity is used from an unusual geography to modify firewall rules. Explain what telemetry and response you expect.