Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,151 questions
Atypical Travel - no info for "Previous Location"
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(86.4, 44%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EK%3C/text%3E%3C/svg%3E)
KyleG
0
Reputation points
Reviewing the output of an Atypical Travel alert, I find detailed information for "Current Location" (City, State, Country), but I only get Country as a result of the "Previous Location". Why is there a discrepancy in the amount of information I can get on both these locations?
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(166.4, 27%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERP%3C/text%3E%3C/svg%3E)
Raja Pothuraju 7,135 Reputation points Microsoft Vendor2024-09-24T13:26:54.94+00:00 Hello @KyleG,
Thank you for posting your query on Microsoft Q&A.
As mentioned, when reviewing the risk log triggered by an atypical travel alert, you were able to find information about the current location but not the previous location’s city and state. I recommend checking the previous sign-in log, using the same timestamp and IP address, to see if the full location (city, state, and country) is displayed.
The "atypical travel" risk event is triggered by an offline detection algorithm after Identity Protection analyzes previous sign-ins. It may help to verify the user's sign-in logs around that time for any missing location details.
If the location is displayed correctly in the sign-in log but not in the risk event, I recommend contacting Support team to provide feedback on the discrepancy.
Thanks,
Raja Pothuraju. -
Raja Pothuraju 7,135 Reputation points Microsoft Vendor
2024-09-26T14:05:23.21+00:00 Hello @KyleG,
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
-
KyleG 0 Reputation points
2024-09-26T16:16:47.71+00:00 Raja,
Thank you for the response. It still doesn't explain how the info in the message can contain the country of the previous location but none of the information associated with that country. Of course, I can correlate other logs to find that information, but, since the message seems to already have that info, I'm not sure why the message can't give me all the information I need.
-
Raja Pothuraju 7,135 Reputation points Microsoft Vendor
2024-09-30T22:50:25.2+00:00 Hello @KyleG,
If you're unable to find logs that contain the country of the previous location, it’s possible that the sign-in log was triggered more than 30 days ago. Since sign-in logs are only available for 30 days, that could explain why you're unable to access the information.
Identity Protection relies on machine learning, and risk detection types take into account past sign-in history (IP, Latitude/Longitude, and ASN) to identify anomalous sign-ins. The system stores data about the locations previously used by a user and considers these "familiar" locations. A risk detection is triggered when a sign-in occurs from a location not already on the list of familiar locations.
Please verify if the user has had any recent sign-ins from the previous location. Given the discrepancy, also check if there are any other risk detections for users showing similar behavior, where only the country is mentioned for previous locations.
Thanks,
Raja Pothuraju.
Sign in to comment
Sign in to answer