SECURITY ANALYSIS SUMMARY
=========================
Clean events: 17
Failed events: 11
Failure rate: 64.71%
Top suspicious IP: 198.51.100.14 (8 failed attempts)
Off-hours failed attempts: 4
Decision threshold: 3 failed attempts

Recommended action:
- Review events from 198.51.100.14.
- Correlate off-hours failures with endpoint and identity logs.
- Validate whether the account owners recognize these attempts.