SOC OP 002: Impossible Travel or Legitimate Login?
Investigate a synthetic identity alert involving apparent impossible travel. You’ll analyze 25 Wazuh events, reconstruct the timeline, correlate authentication, MFA, endpoint, access-gateway, application, and asset evidence, test competing explanations, and produce a defensible incident assessment. The goal is not to prove compromise—it is to determine what the complete evidence supports while clearly documenting confidence, limitations, alternatives, and unknowns.