The cost of a noisy rule
A rule that flags any failed login would fire on every typo. Real users fat-finger passwords two or three times and then succeed, from internal addresses. A good analyst tunes the threshold so those benign bursts stay quiet while the brute force still trips it. You will do exactly that on a sample log in the lab.