Is there a way to duplicate an Impossible Travel policy, or use it as a template (anomaly based policies are not listed as options for a template for me)?
The goal is to have two separate policies: one that will record only successful impossible travel sing ins, and second one that will record failed impossible travel sing ins. This way an admin could configure related alerting, triage, and governance properly for each of these policies.
(I'm aware that Multiple Failed Login Attempts policy could be used and tuned to alert for the failed sing ins, but this won't utilize the anomaly based capability given with this Impossible Travel policy.)
So, I'm just curios if anybody had luck with a similar task?
Thank you! :)