json authentication_failure ^/api/v\d+/auth/login$ Ghaymah API: Single authentication failure on login endpoint. authentication_failed,gdpr_IV_32.2,hipaa_164.312.b,pci_dss_10.2.4, no_full_log 100200 Ghaymah API: Possible brute force — $(srcip) failed 5+ logins in 60 seconds against $(data.target_user). T1110.001 T1078 authentication_failures,brute_force_early,gdpr_IV_35.7.d,pci_dss_11.4, 100200 Ghaymah API: CONFIRMED brute force attack from $(srcip) — 20+ failures in 2 minutes. Target: $(data.target_user). T1110.001 T1110.003 brute_force_confirmed,gdpr_IV_35.7.d,pci_dss_11.4,nist_800_53_SI.4, alert_by_email 100200 Ghaymah API: AGGRESSIVE brute force from $(srcip) — 50+ failures in 2 minutes. AUTOMATIC BLOCK INITIATED. T1110.001 T1110.003 T1110.004 brute_force_aggressive,gdpr_IV_33,pci_dss_11.4,nist_800_53_SI.4, alert_by_email 100200 data.target_user Ghaymah API: DISTRIBUTED brute force — 10+ different IPs targeting account $(data.target_user) in 5 minutes. T1110.004 T1078 brute_force_distributed,credential_stuffing,gdpr_IV_33,pci_dss_11.4, alert_by_email 100200 data.target_user Ghaymah API: PASSWORD SPRAY detected — $(srcip) targeting 10+ different accounts in 5 minutes. T1110.003 password_spray,brute_force_distributed,gdpr_IV_33,pci_dss_11.4, alert_by_email 100202 authentication_success Ghaymah API: ⚠️ CRITICAL — Successful login from $(srcip) AFTER confirmed brute force. Account $(data.target_user) likely COMPROMISED. T1078 T1110 account_compromised,brute_force_success,gdpr_IV_33,pci_dss_10.2.4,nist_800_53_SI.4, alert_by_email authentication_success ^/api/v\d+/auth/login$ data.target_user data.geoip.country_code Ghaymah API: IMPOSSIBLE TRAVEL — $(data.target_user) authenticated from 2+ countries within 1 hour. Possible credential compromise. T1078 impossible_travel,account_compromised,gdpr_IV_33, alert_by_email 100200 ^svc-|^service-|^system- Ghaymah API: ⚠️ CRITICAL — Brute force targeting SERVICE ACCOUNT $(data.target_user) from $(srcip). Service accounts have elevated privileges! T1110.001 T1078.001 brute_force_service_account,gdpr_IV_33,pci_dss_10.2.4, alert_by_email