Triage queue
// Operations
Impossible travel for jsmith
Successful logon from Lahore, PK 41 minutes after the same account authenticated from Chicago, USA.
ALT-971696CriticalInvestigating
92Severe
This alert has been escalated. Open the incident to see the full case.
Why this fired
Rule: Impossible travel
Same username authenticating from two countries within 180 minutes
The same account authenticating from two countries closer together in time than travel between them would allow. Strong evidence that a credential is being used by someone other than its owner.
Triggering event
The exact record that satisfied the rule.
Authentication SuccessHigh2026-09-04 14:27:29ZWIN-DC01
Kerberos TGT issued for jsmith from 185.100.200.50 (logon type 10, RDP) — prior successful logon for this account originated in Chicago, USA 41 minutes earlier
What else was happening
Other activity for jsmith in the surrounding hour.
| Time | Event | Severity | Host |
|---|---|---|---|
| 2026-09-04 14:17:53Z | Authentication Failure | Low | WIN-DC01 |
| 2026-09-04 14:21:05Z | Authentication Failure | Low | WIN-DC01 |
| 2026-09-04 14:24:17Z | Authentication Failure | Low | WIN-DC01 |
| 2026-09-04 14:30:29Z | Mfa Method Removed | High | WIN-DC01 |
| 2026-09-04 14:33:29Z | User Created | Critical | WIN-DC01 |
| 2026-09-04 14:36:29Z | Process Execution | High | WIN-DC01 |
| 2026-09-04 14:39:29Z | Credential Access | Critical | WIN-DC01 |
Alert
- Raised
- 7d ago
- Last updated
- 7d ago
- Risk score
- 92
- Source
- WIN-DC01
- Origin
- Lahore, Pakistan
- Detected by
- Correlation rule
Entity risk
94Severe
jsmith carries a standing risk score derived from all of its activity, not just this alert.
Open the entity profile