One Session Identifier Appears from Distant Locations
Detects the same authentication session or token identifier used from geographically inconsistent locations within a short period. This could indicate session hijacking or an adversary using a compromised session from a different location.
Splunk (SPL)
