Question

A SOC analyst at a global logistics company reviews raw SIEM alerts and finds that a high volume of 'impossible travel' authentication alerts are being generated. Investigation reveals that many involve legitimate users connecting through the company's regional VPN concentrators and corporate proxy egress points, which cause geolocation to appear inconsistent. The SOC lead wants to reduce noise while preserving genuine detection capability for compromised credentials. Which action MOST effectively improves the fidelity of these detections?

Accepted Answer

Enrich authentication events with asset and network context (known VPN/proxy egress ranges, corporate ASN, device posture) so correlation logic can exclude sanctioned egress before evaluating travel velocity

Answer

Disable the impossible-travel rule entirely and rely on endpoint EDR to detect credential compromise

Answer

Increase the impossible-travel velocity threshold to a value higher than any commercial flight speed to eliminate all false positives

Answer

Route all impossible-travel alerts directly to a suppression list and review them only during quarterly audits