Skip to main content
Tier One
Medium

Impossible travel flagged for a user on the corporate VPN

A-1048

00:00time on this alert, target 20 minutes

Back to queue

Alert details

Source
Cloud Audit Log
Detection rule
CLOUD-IDENT-TRAVEL-004
Affected user
l.nowak
Affected host
WKS-ENG-07
Source IP
20.115.60.14
First seen
2026-07-24T14:26:00Z

Why this fired, in plain English

The same account signed in from two distant places quickly — but the rule cannot tell whether a VPN moved the apparent location.

Suggested playbook

Impossible travel / anomalous sign-in

  1. 1. Compare device IDs and user agents between the two sign-ins.
  2. 2. Check the VPN logs — corporate VPN egress is the single most common cause of false positives.
  3. 3. Check the IP owner: corporate egress, consumer ISP, hosting provider, or anonymizer?
  4. 4. Check MFA state on each sign-in.
Open the full checklist

Raw log evidence

Exactly what the tools recorded — 3 events.

  1. ts=2026-07-24T14:20:11Z src="cloud_audit" event=UserLoggedIn user="l.nowak@northwind-mfg.example" src_ip=71.12.88.104 geo="Cedar Rapids, US" device_id="D-51188" mfa=satisfied user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) Edge/126"

  2. Guided hint: this line matters

    ts=2026-07-24T14:26:02Z src="cloud_audit" event=UserLoggedIn user="l.nowak@northwind-mfg.example" src_ip=20.115.60.14 geo="Amsterdam, NL" device_id="D-51188" mfa=satisfied user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) Edge/126"

    Same device_id and same browser as the earlier sign-in — the machine did not change, only the exit IP did.

  3. Guided hint: this line matters

    ts=2026-07-24T14:25:47Z src="vpn" event=tunnel_up user="l.nowak" client_ip=71.12.88.104 assigned_ip=10.20.240.51 egress_gateway="ams-gw-02" egress_ip=20.115.60.14

    The VPN log shows the user connected 15 seconds earlier and was routed out through the Amsterdam gateway.

Related events

The order things happened in.

  1. 14:20Z

    Local sign-in from Cedar Rapids

  2. 14:25Z

    Corporate VPN tunnel established via ams-gw-02

  3. 14:26Z

    Sign-in appears from Amsterdam

Enrichment lookups

Mock lookups. Run each one yourself — a real analyst never guesses what a lookup would have said. There is no "run everything" button on purpose.

0 of 4 lookups checked

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

techniques

Your verdict

Keyboard shortcuts 1–4, or click. You can always change your mind afterwards.