Impossible Travel Time Azure

Tracing Logins from two different countries with impossible travel times between consecutive logins per identity

CQL · Falcon Next-Gen SIEMCopy query

Loading query…

Impossible_Travel_Time_Azure.yml

Aamir Muhammad

Hunting

Network, Identity

Identity, CSPM / ASPM / DSPM

Want this running in your SIEM — with someone on call?

Our Managed SIEM team operates CrowdStrike Falcon Next-Gen SIEM in production, with over 350 battle-tested use cases and 24/7 incident response behind them.

Talk to the SIEM team