CyberArk Failed Logins

This correlation rule will trigger in an event in which 4 or more Failed Logins events occurred from a single user during a 10 minutes timeframe.

CyberArk Identity MEDIUM CREDENTIAL_ACCESS

datamodel dataset = cyberark_identity_raw 
|filter xdm.event.type="Cloud.Core.LoginFail"
|comp count(xdm.event.type) as `Failed Logins` by xdm.target.user.username, xdm.source.ipv4 
|filter  `Failed Logins` >=4