Flag sign-ins that cannot be physically real. When the same user appears in two places far apart within a window shorter than travel would allow, it usually means a token or session is being reused from a new location. Lidar's impossible_travel monitor raises a Signal against the subject so you can challenge or step up.
What you use
- The Lidar
impossible_travelmonitor (detection:impossible_travel distanceKm:>5000), correlated by subject.
Setup
- Confirm Lidar access is approved for the environment.
- Under Lidar > Monitors, enable
impossible_travel. The defaultdistanceKm:>5000is advisory text injected into the detector prompt, not a hard gate; tune it to the distance that matters for your user base. - Pair with step-up or a challenge step in your app for users who trip the monitor, rather than blocking outright; a real user on a VPN can look like impossible travel.
Verify
- In dev, sign in as one user from two geographically distant IPs within a few minutes: a Signal appears against that subject.
- Confirm a normal sign-in from the user's usual location does not fire.
- Triage the Signal in Lidar > Signals; the finding is a derived detection, so correlate with neighboring audit events before remediating.
Related
- Lidar concepts: subject-keyed correlation and the role of advisory tokens.
- Audit logs: the underlying event trail to correlate against.
- MFA: step-up as the response to a Signal.