A SOC analyst receives an alert from the SIEM: 'User account jsmith logged in from two geographically disparate locations within 10 minutes (New York and Tokyo).' What is the first analytical step to determine if this is a true positive?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need to classify the source IPs first, because impossible travel alerts often fire when a user hops between VPN exit nodes. Check VPN, cloud, and proxy lists, then look at travel records and password resets before calling it compromise.
Full Explanation
The correct first analytical step is to verify the originating IPs against known VPN exit nodes, cloud service IPs, and proxy or anonymizer lists, then check the user's travel records and recent password reset activity before concluding compromise. Impossible travel alerts frequently fire on VPN users who appear to travel instantaneously as they switch between VPN exit nodes, so systematic IP classification combined with HR travel records distinguishes a false positive from a credential compromise. Locking the account immediately and notifying HR is wrong because it disrupts legitimate users before validation and should follow confirmed compromise. Dismissing the alert as an impossible travel false positive caused by VPN usage is wrong because it ignores the possibility of genuine credential theft. Sending the user an email asking where they are currently located is wrong because it can tip off an insider threat and is an unreliable primary investigative method.