Code
Triage authentication logs
Separate the attack from the noise, and write the detections.
Fill it in
Authentication events.
You cannot spot abnormal without normal.
Portable detections, with the false-positive rate.
Your prompt
Triage the authentication logs in . Baseline first. You cannot identify abnormal without normal, and normal here is specific: office hours, a handful of countries, known user agents, and a failure rate that is never zero because people forget passwords. Look for the patterns that matter: many users from one source (credential stuffing), one user from many sources (a shared or stolen credential), a low rate spread over days to stay under thresholds, and a success immediately after a long run of failures, which is the only one that is definitely bad. Distinguish an attempt from a COMPROMISE, clearly. A report that presents 40,000 failed logins without saying whether any succeeded causes a panic and answers nothing. Write Sigma rules for the detections, each with the expected false-positive rate and what to tune. A rule that fires constantly is turned off within a week.
Continue and pick your folderOpens with everything above already filled in.
Why this works
A report presenting 40,000 failed logins without saying whether any succeeded causes a panic and answers nothing. This baselines normal first, separates attempt from compromise, and writes detections with their expected false-positive rate.