Question about "anomalous token" alerts

I am a security analyst working with Sentinel, and every now and again we get the alert "Anomalous token involving one user". "This detection indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location. This detection covers Session Tokens and Refresh Tokens."

Now, I usually revoke sessions and move on. But I can't help but feel I need to understand more about this. I know …

alert alerts analyst cybersecurity detection lifetime location question security security analyst sentinel session token tokens working