Impossible Travel Login Detection

Use case development / Detect Unauthorized Access / Detect Impossible Travel

kql

Detection rule

SigninLogs
| where ResultType == 0
| extend Country = tostring(LocationDetails.countryOrRegion)
| extend City = tostring(LocationDetails.city)
| summarize
    Countries = make_set(Country),
    Cities = make_set(City),
    Logins = count()
    by UserPrincipalName, bin(TimeGenerated, 1h)
| where array_length(Countries) > 1
| extend IsPossibleTravel = true

Test cases

• Login from two countries within short timeframe

False positive guidance

Account for VPN usage and traveling executives.

Detection course