Tactical InfoSec2 min read
Monitor for the Impossible
Alert on things that should never happen — they signal compromise.
Saved only in this browser. No account needed. Does not sync. Clearing browser data removes the list.
Published
The highest-signal alerts aren't about volume; they're about impossibility. A service account logging in interactively, or a login from two continents in five minutes, isn't suspicious — it's compromised, and worth waking someone for.
“The best alert isn't 'unusual.' It's 'impossible.'”