Cross-region GraphApiAuditEvents activity indicating token replay (impossible travel)

Duo Tech@duotech

•updated Aug 10, 2026•2•0•7

Detects cross-region GraphApiAuditEvents calls for the same AccountObjectId/ApplicationId occurring faster than plausible travel time, indicating a replayed/stolen session token.