IAM Event - User Location - Outside Approved Location

Event

Outside approved location - Login Location Behavior IP and Geolocation - Foreign Login.

Recommended action

Contact the Customer or User and make them aware of this event.  Force log-out from all devices and temporarily disable login for the user account, then change the User password and make sure MFA is enabled for the User.   Evaluate firewall rules for geolocation where applicable.

Alert type

Critical