## Use Case 3: Impossible Travel (Medium)

**Scenario**: A user's credentials have been compromised (stolen/phished). The attacker is logging in from their own country, while the legitimate user is logging in from the office.

### The Logic
A physical person cannot move faster than the speed of an airplane.

### 1. The Data Sources
*   **Source**: Identity Provider Logs (Azure AD, Okta, PingIdentity) or VPN Logs.
*   **Key Fields**:
    *   `User ID`: The account.
    *   `Source IP`: The login location.
    *   `GeoIP Data`: The SIEM enriches the IP with City/Country data.
    *   `Timestamp`.

### 2. The Pattern
*   Login 1: London, UK at 14:00.
*   Login 2: New York, USA at 14:30.
*   Distance: 3,450 miles.
*   Time Delta: 30 minutes.
*   Required Speed: 6,900 mph. (Supersonic).
*   **Conclusion**: Two different people are using the same credentials.

### 3. The SIEM Rule (Pseudocode)
```sql
Alert IF:
    Login Success for User U from Location A at Time T1
    AND
    Login Success for User U from Location B at Time T2
    AND
    (Distance(A, B) / (T2 - T1)) > 600 mph
```

### 4. Investigation Steps (The Playbook)
1.  **Verify the GeoIP**: Geo-location databases are not 100% accurate.
    *   Is the IP *actually* in Russia, or is it a corporate VPN exit node that just *registers* to a HQ in Russia?
2.  **Check for VPN Usage**:
    *   Did the user turn on their corporate VPN? This might make them appear to "jump" from home to the datacenter instantly.
3.  **Contact the User**: "Hey, are you currently in Lagos, Nigeria?"
4.  **Review Activity**:
    *   What did the "Remote" session do? Did they just check email, or did they download the entire "Payroll" folder?

### 5. False Positives
*   **Mobile + WiFi**: A user is on WiFi (IP A), then switches to 5G (IP B). IP B might geolocate to a carrier tower 300 miles away.
*   **Cloud Proxies**: Zscaler or other cloud security tools can make traffic appear to originate from regional hubs.

### 6. Remediation
*   **Force Password Reset**: Invalidate the compromised credentials.
*   **Revoke Sessions**: Kill active tokens so the attacker is kicked out immediately.
*   **Enable MFA**: If not already on, this stops 99% of credential theft attacks.