ConceptsImpossible Travel

Impossible Travel

An identity anomaly where one account signs in from two locations too far apart to travel between in the elapsed time, strongly suggesting the credentials are being used by more than one party, often an attacker.

Glossary definition

6 direct links2 lessons

Concept Neighborhood

Prerequisite · arrow shows the orderRelated · bigger circles cover more lessons

Start here

Identity Telemetry

The foundation Impossible Travel builds on, worth understanding first.

Open concept →

Prerequisitelearn this first

Identity TelemetryStart here

The activity data generated by identity systems, sign-ins, authentication results, privilege changes, access grants, and federation events, that feeds detection, hunting, and investigation of identity-based threats.

lessons

Relatedsorted by lesson coverage

Impossible Travel Hunting

lessons

IAM Detection for Meridian

lessons

Conditional Access

lessons

Credential Stuffing

lessons

Identity Anomaly Detection

lesson

Related Lessons

2 lessons cover this concept

Identity ATT&CK Patterns and Defender Signals

General Beginner

IAM Security Operations and Career

IAM Engineer