-
Google Workspace Impossible Travel Login
Sep 19, 2026 · Domain: Cloud Domain: Identity Data Source: Google Workspace Data Source: Google Workspace User Log Events Data Source: Google Workspace Audit Logs Use Case: Threat Detection Use Case: Identity and Access Audit Tactic: Initial Access Tactic: Credential Access Resources: Investigation Guide Noise: Medium Performance: Fast Profile: Recommended Threat: Impossible Travel Rule Type: ES|QL Platform: Google Workspace Domain: SaaS ·Detects successful Google Workspace sign-ins for the same user from two geographically separated locations within a 90-minute window, where the implied travel speed between the two points exceeds what is physically possible (>=800 km/h, faster than modern commercial airliners) and the geographic separation is at least 500 km. This pattern indicates either VPN/proxy use or an adversary signing in to a compromised account from a different location than the legitimate user.
Read More -
Google Workspace User Login with Unusual ASN
Sep 19, 2026 · Domain: Cloud Domain: Identity Data Source: Google Workspace Data Source: Google Workspace User Log Events Data Source: Google Workspace Audit Logs Use Case: Threat Detection Use Case: Identity and Access Audit Tactic: Initial Access Tactic: Credential Access Resources: Investigation Guide Noise: High Performance: Normal Profile: Aggressive Rule Type: New Terms Platform: Google Workspace Domain: SaaS ·Detects the first time a Google Workspace user successfully signs in from a given source ASN within a 14-day historical window. Most users have a stable set of egress ASNs (home ISP, corporate VPN, mobile carrier). A new ASN for a user is a meaningful anomaly as it surfaces ISP changes and travel, but also catches AiTM phishing-kit relays whose egress ASN was never previously associated with the user.
Read More