> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-reference/detections/suspicious-countries.md).
# Suspicious Countries
A suspicious country is a country that your organization never expects to record logins or activity from. These countries are listed in Workbench and can be edited by you at any time.
If there is an incoming event with activity originating from a country included on this list, we will use our detections to automatically raise an Expel Alert in Workbench for analyst review.
## Default Countries
The following countries (indicated in Workbench by their two-letter ISO 3166 codes) are automatically included in your list of suspicious countries:
* Nigeria
* Kenya
* Tanzania
* Pakistan
* North Korea
{% hint style="warning" %}
For most Expel customers, there are no employees or contractors geolocated in (or working out of) these countries and any business presence is limited. Therefore, any authentication from these countries is always treated as suspicious.
{% endhint %}
## View or Edit the Suspicious Countries
If you need additional help with any of your suspicious countries settings, contact [Support](/support/how-to-reach-us.md).
{% hint style="info" %}
You can also access a read-only view of this list by going to **Detections > Detection Strategy** and selecting the **Suspicious Authentication** tab. Look for the **Suspicious authentication source countries** box.
{% endhint %}
1. [Log in to Workbench](https://workbench.expel.io/auth/login?orig=%2F).
2. Navigate to **Organizations > My Organization**.
3. Scroll down and select the **Configuration** tab.
4. Scroll down to `detect.alert.authentication.suspicious_countries` and look for the two-letter ISO 3166 codes indicating the suspicious countries.
5. You can add or remove countries here if needed, and select Save.
### Related Settings
You may also wish to configure some related settings while in the **Configuration** tab:
* `Detect.alert.authentication.expected_countries` - this is a list of countries from which you expect authentication.
* `Detect.alert.authentication.outside_expected_countries_duet` - this checkbox is useful if your team would always like to be notified of any login activity outside of the Expected Countries list.
* Enabling this setting will result in a [Verify Action](/workbench-reference/investigations-and-incidents/understanding-investigations.md#verify-action) being sent to your team whenever this type of login activity occurs.
* `Detect.alert.authentication.ofac_countries` - this is a list of OFAC countries from which you do not expect authentication.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.expel.io/workbench-reference/detections/suspicious-countries.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.