Impossible travel detection from successive logins
Two successful logins, two countries, and not enough time to have made the trip. Each login is valid on its own.
CYBERDETECT compares the identity events you already collect and flags a pair whose distance and time cannot be a real journey.
The same identity pack also covers account takeover, credential stuffing, a new device, and OTP relay, so the travel signal stays attached to the rest of that user's session.
The alert lands in Slack, Teams, or your SOAR. Setup is the cloud service, or an on-prem agent when those logs must stay local.