User Geolocation Logon Pattern Analysis

Derived by composition, not from a source that names this pair. D3FEND publishes that User Geolocation Logon Pattern Analysis counters T1190 Exploit Public-Facing Application; SafeMode's curated mapping records IA-0007 as addressing that same adversary behaviour in the space domain. The control assumes an enterprise host or network -- interactive user accounts, IP session structure, or an organisational perimeter -- so it reaches the mission ground segment and not the spacecraft. Recorded at moderate confidence because the supporting chain is two documented edges rather than one source attesting the pair directly.