Brute Force and Spray attacks - use case
1- Multiple accounts failed logon from the same IP - within 1 minute
2- Single account failed logon from multiple hosts - in 1 minute
3- 1 user account failed to log to 3 hosts destination - in 2 minutes