A SIEM analyst creates a use case to detect user accounts logging in from two geographically distant locations within a short time window. What type of detection is this?

B is correct because detecting logins from physically impossible locations in a short time window is a classic anomaly detection (impossible travel) use case based on deviations from expected user behavior. A is wrong because signature-based detection matches specific known patterns; there is no signature for geographic distance. C is wrong because vulnerability scanning identifies weaknesses in systems, not behavioral anomalies in authentication logs. D is wrong because protocol anomaly detection looks for malformed or unusual protocol behavior at the network level.