Palo Alto Prisma Cloud - Multiple failed logins for user

let threshold = 10;
PaloAltoPrismaCloud
| where ResourceType =~ 'Login'
| where EventResult =~ 'Failed'
| where EventMessage !has 'access key'
| summarize count() by UserName, bin(TimeGenerated, 5m)
| where count_ > threshold
| extend AccountCustomEntity = UserName

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: AccountCustomEntity
tactics:
- CredentialAccess
requiredDataConnectors:
- dataTypes:
  - PaloAltoPrismaCloud
  connectorId: PaloAltoPrismaCloud
id: 4f688252-bf9b-4136-87bf-d540b5be1050
severity: Medium
status: Available
query: |
  let threshold = 10;
  PaloAltoPrismaCloud
  | where ResourceType =~ 'Login'
  | where EventResult =~ 'Failed'
  | where EventMessage !has 'access key'
  | summarize count() by UserName, bin(TimeGenerated, 5m)
  | where count_ > threshold
  | extend AccountCustomEntity = UserName  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/PaloAltoPrismaCloud/Analytic Rules/PaloAltoPrismaCloudMultipleFailedLoginsUser.yaml
kind: Scheduled
queryPeriod: 1h
version: 1.0.1
name: Palo Alto Prisma Cloud - Multiple failed logins for user
queryFrequency: 1h
triggerThreshold: 0
relevantTechniques:
- T1110
description: |
    'Detects multiple failed logins for the same user account.'
triggerOperator: gt