https://community.splunk.com/t5/Splunk-Search/How-to-track-impossible-travel-events-for-users-who-are-logging/m-p/630191#M218937 <P>There are examples of that query in the Splunk Security Examples app.&nbsp; None of them fit your exact scenario, but they should be adaptable to your environment.</P> Wed, 08 Feb 2023 21:44:47 GMT richgalloway 2023-02-08T21:44:47Z https://community.splunk.com/t5/Splunk-Search/How-to-track-impossible-travel-events-for-users-who-are-logging/m-p/630174#M218929 <P>Good afternoon,</P> <P>I'm looking for a way to track impossible travel events for users who are logging in to applications using Duo 2fa. Basically if a user gets a duo push from an IP, lets say in America, then another duo event in France within a short time period, this would be an event we want to investigate. Is it possible to do this using splunk queries?</P> Wed, 08 Feb 2023 22:32:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-track-impossible-travel-events-for-users-who-are-logging/m-p/630174#M218929 drathbo 2023-02-08T22:32:16Z https://community.splunk.com/t5/Splunk-Search/How-to-track-impossible-travel-events-for-users-who-are-logging/m-p/630191#M218937 <P>There are examples of that query in the Splunk Security Examples app.&nbsp; None of them fit your exact scenario, but they should be adaptable to your environment.</P> Wed, 08 Feb 2023 21:44:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-track-impossible-travel-events-for-users-who-are-logging/m-p/630191#M218937 richgalloway 2023-02-08T21:44:47Z https://community.splunk.com/t5/Splunk-Search/How-to-track-impossible-travel-events-for-users-who-are-logging/m-p/630701#M219105 <P>Thanks for the answer. What is the Splunk Security Examples app? I logged into my splunk instance and didn't see an app with that name. Thanks again!</P> Mon, 13 Feb 2023 19:32:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-track-impossible-travel-events-for-users-who-are-logging/m-p/630701#M219105 drathbo 2023-02-13T19:32:06Z https://community.splunk.com/t5/Splunk-Search/How-to-track-impossible-travel-events-for-users-who-are-logging/m-p/630727#M219114 <P>if you don't see the SSE app on your instance then it will have to be installed from splunkbase (<A href="https://splunkbase.splunk.com/app/3435" target="_blank">https://splunkbase.splunk.com/app/3435</A>).</P> Tue, 14 Feb 2023 00:59:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-track-impossible-travel-events-for-users-who-are-logging/m-p/630727#M219114 richgalloway 2023-02-14T00:59:41Z