Alert on Impossible Journeys

Graylog Central (peer support)
1

Is there any way to alert on impossible journeys?

I would like to trigger an alert when a user logs in from one IP address then logs in from another IP in the space of half an hour, has anyone ever created anything like this?
This alert could show a user logging in from an IP in the UK and then 15 minutes later logs in from the US, this could be indicative of the user’s account being compromised.

Cheers,

G

1 Like
2

Any ideas please? I have looked further into this problem and still can’t find a solution.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.