Detect impossible travel

Flag sign-ins that cannot be physically real. When the same user appears in two places far apart within a window shorter than travel would allow, it usually means a token or session is being reused from a new location. Lidar's impossible_travel monitor raises a Signal against the subject so you can challenge or step up.

What you use

• The Lidar impossible_travel monitor (detection:impossible_travel distanceKm:>5000), correlated by subject.

Setup

1. Confirm Lidar access is approved for the environment.
2. Under Lidar > Monitors, enable impossible_travel. The default distanceKm:>5000 is advisory text injected into the detector prompt, not a hard gate; tune it to the distance that matters for your user base.
3. Pair with step-up or a challenge step in your app for users who trip the monitor, rather than blocking outright; a real user on a VPN can look like impossible travel.

Verify

• In dev, sign in as one user from two geographically distant IPs within a few minutes: a Signal appears against that subject.
• Confirm a normal sign-in from the user's usual location does not fire.
• Triage the Signal in Lidar > Signals; the finding is a derived detection, so correlate with neighboring audit events before remediating.

Related

• Lidar concepts: subject-keyed correlation and the role of advisory tokens.
• Audit logs: the underlying event trail to correlate against.
• MFA: step-up as the response to a Signal.