A SOC team is informed that a UK-based user will be traveling between three countries over the next 60 days. Having the names of the 3 destination countries and the user's working hours, what must…

Alerting on failed VPN attempts monitors authentication errors that are common for legitimate users mistyping passwords, and it does not use the destination country context to distinguish normal from abnormal behavior.

Because the analyst already knows the three approved destination countries and the UK home base, a successful VPN login from any other country cannot be explained by the user's legitimate travel and indicates either account compromise or unauthorized access. Creating a rule that fires on even a single successful connection from a non-destination country uses the available intelligence to define a precise allowlist and alerts on any deviation from it. This approach converts the known travel context into a high-fidelity detection rule with minimal false positives.

Successful VPN connections originating from the three known destination countries are expected, normal behavior for this user, so alerting on them would generate false positives rather than detect anomalies.

Retroactively analyzing logs during the travel period is a reactive investigation activity, not a proactive detection rule, and delays identifying abnormal behavior in a timely manner.