In the event that a tenant is seeing a large volume of failed logins - can there be - 1. A way to opt in to notifications for a certain failed login threshold. 2. The platform observes the failed logins, and escalates to the soc as a priority if a breach is spotted. Kind of an attack disruption engine for ITDR.