Hunting Impossible Travel in Sentinel with KQL
Two sign-ins too far apart in time and distance to be one person. In Sentinel, KQL's prev() and a distance function are all it takes.
Series
KQL Hunting
Practical threat hunting queries for Microsoft Sentinel, written in KQL.
Posts in this series
Getting Started with Sentinel Hunting: A KQL Primer for People Who Keep Putting It Off
A KQL primer for hunting in Microsoft Sentinel: five operators, one mental model, and why you never trust a detection you can't read.
Hunting MFA Fatigue in Sentinel: Building the Detection One Line at a Time
Push-bombing leaves a loud shape in SigninLogs. In Sentinel, a KQL count, a threshold and a join are enough to catch it.
Hunting Password Spray in Sentinel: One Password Against a Thousand Doors
Brute force tries many passwords on one account. Spray tries one password on many accounts and hides under your lockout threshold.
