Techniques
Sample rules
Impossible Travel
- source: sigma
- technicques:
- t1078
Description
Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.
Detection logic
condition: selection
selection:
riskEventType: impossibleTravel