Check Point Harmony Email & Collaboration impossible travel detected
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Goal
Detects geo-suspicious activity flagged by Check Point, where a user performs actions from two geographically distant locations within an improbable time frame. This behavior may indicate credential theft, session hijacking, or unauthorized account access.
Strategy
This is a threshold-based rule that alerts when Check Point generates a Superman anomaly event, which is the same as an impossible travel detection. The event indicates that the user’s activity cannot logically originate from both observed locations within the given timeframe.
Triage and Response
- Review the user email address
{{@usr.email}} and analyze the locations of the flagged events. - Determine if the user has a history of similar anomalies or if they are using a known VPN or remote access service.
- If unauthorized access is suspected, force a logout from all active sessions, reset the user’s credentials, and enable multi-factor authentication (MFA) if not already enforced.
- Monitor for additional suspicious activity and restrict access if necessary to prevent further unauthorized use.
