Suspicious Impossible-Travel Login Activity: Same User Logging In From Two Cities in the Same Country Within 30 Minutes
* Compare distances and times of consecutive sign-ins for the same user. * Flag events where travel speed exceeds physical limits as potential unauthorized access. Example: Same user signing in from Chennai to Mumbai (India) in 30 minutes triggers an alert. Distance - 5,560 km. Required speed - 11,000 km/h The event is flagged as impossible travel.
Splunk (SPL)
