medium10 pts · first answer countsalert-triagecloud-identity
Triage an impossible travel alert
A user signed in from Dubai and, 20 minutes later, from Frankfurt. What is the best next step before declaring a compromise?
Discussion 0
Join free to post in the discussion.
Related questions
- IOC vs IOACybersecurity Analyst
- False positive or false negative?Cybersecurity Analyst
- Brute force or password spraying?Cybersecurity Analyst
- What a Tier 1 SOC analyst doesCybersecurity Analyst
- Failed logons followed by successCybersecurity Analyst
- Suspicious process tree in EDRCybersecurity Analyst
- Reading the logon typeCybersecurity Analyst
- KQL for failed Entra sign-insCybersecurity Analyst