Building a Microsoft Sentinel detection rule for impossible travel sign-in activity using Azure SigninLogs and KQL. Investigating user logon geography and working the incident to closure under NIST SP 800-61.
Login anomaly detection: impossible travel, fail bursts, and device churn (Python + TypeScript)
Full red/blue team MFA compromise & IR lab — exploited MFA enabled vs enforced gap, detected impossible travel, executed Contain → Eradicate → Recover cycle
To associate your repository with the impossible-travel topic, visit your repo's landing page and select "manage topics."