← Alert queue
SL-1009mediumCloud · Beginner · raised Oct 23, 14:16

Impossible travel activity

One employee's account signed in from two countries only 12 minutes apart. That is too fast to travel. Either someone else has the password, or a VPN (a tool that hides your real location) is making it look that way.

Your task: Decide if someone else is using this account. Compare the two sign-ins and look at what happened afterwards.

Assign this alert to yourself to see the evidence and start investigating.

Found something confusing or unrealistic?