A SIEM analyst creates a use case to detect user accounts logging in from two geographically distant locations within a short time window. What type of detection is this?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — detecting logins from physically impossible locations in a short time window is classic anomaly detection, specifically impossible travel. You're spotting deviations from expected user behavior, not matching a known attack signature.
Full Explanation
Anomaly detection based on behavioral baseline deviation (impossible travel) is correct because detecting logins from physically impossible locations in a short time window is a classic anomaly detection use case based on deviations from expected user behavior. Signature-based detection using known attack patterns is wrong because it matches specific known patterns; there is no signature for geographic distance. Vulnerability scanning-based detection is wrong because vulnerability scanning identifies weaknesses in systems, not behavioral anomalies in authentication logs. Protocol anomaly detection is wrong because it looks for malformed or unusual protocol behavior at the network level.