ALT-2416 · Entra ID
Impossible travel sign-in
Successful sign-ins from Jakarta and Frankfurt 41 minutes apart for the same account.
mediumFalse Positiveconfidence 61% · 1970-01-01 06:35:00Z · rule DET-0044 Geo-velocity Anomaly
Detection summary
Successful sign-ins from Jakarta and Frankfurt 41 minutes apart for the same account.
- Affected host
- WS-FIN-014
- Affected user
- adm.helpdesk
- Source IP
- 10.20.18.108
- Detection rule
- DET-0044 Geo-velocity Anomaly
- Log source
- Entra ID
- Assignee
- Unassigned
Recommended actions
- Confirm travel with the user
- Review session tokens
- Revoke refresh tokens if unconfirmed
Analyst decision
Triage checklist
- 1. Confirm the detection logic matched genuine activity.
- 2. Check user and asset context for expected behaviour.
- 3. Pivot on host, user, IP and hash in the Log Explorer.
- 4. Enrich IOCs with threat intelligence.
- 5. Set a verdict and record your reasoning.