ByteRay CQL Hub
← All queries

Cisco Duo - Atypical Travel (Impossible Travel)

Cisco Duo Impossible Travel detects simultaneous logins from geographically distant locations, indicating potential credential compromise or unauthorized account usage leveraging valid credentials.

CQL · Falcon Next-Gen SIEMCopy query
#Vendor = cisco
| #event.module = "duo"
| event.action = "authentication"
| groupBy([user.name],function=[count(field=source.geo.country_name, distinct=true, as=country_count),collect(fields=source.geo.country_name),min(@timestamp, as=start_time),max(@timestamp, as=end_time)])
| country_count > 1
| time_diff_hr := (end_time - start_time) / 3600000
| time_diff_hr <= 1
| start_time_fmt := formatTime("%Y-%m-%d %H:%M:%S", field=start_time, timezone=UTC)
| end_time_fmt := formatTime("%Y-%m-%d %H:%M:%S", field=end_time, timezone=UTC)
| drop([start_time, end_time])
| sort([user.name])

Cisco Duo Impossible Travel detects simultaneous logins from geographically distant locations, indicating potential credential compromise or unauthorized account usage leveraging valid credentials.

cisco_duo_atypical_travel_impossible_travel.yml
T1078
Kundan Kumar
Detection
Other
2026-06-05
2026-06-05

Get this query running in your SIEM, with someone on call.

Our Managed SIEM team operates CrowdStrike Falcon Next-Gen SIEM in production, with over 350 battle-tested use cases and 24/7 incident response behind them.

Talk to the SIEM team