Failed login velocity: 5 in 5 minutes

Original English

If a user fails to log in 5 or more times within 5 minutes, send a liveness check via SMS.

Compiled AST

{
  "name": "Failed login velocity: 5 in 5 minutes",
  "action": {
    "sink": "identity",
    "params": {
      "verb": "liveness_check",
      "severity": "med"
    }
  },
  "stages": [
    {
      "id": "failed_logins",
      "type": "counter",
      "match": {
        "eq": false,
        "field": "success"
      },
      "stream": "logins",
      "requires_count": 5,
      "remember_for_seconds": 300
    }
  ],
  "join_key": "user_id",
  "description": "If a user fails to log in 5 or more times within 5 minutes, send a liveness check via SMS."
}