OpenAI Brute Force Login Success

Detects successful credential stuffing or brute force attacks against OpenAI accounts. This rule identifies when a user account experiences 5 or more failed login attempts followed by a successful login within 30 minutes. This pattern indicates: - Successful credential stuffing attack - Successful brute force attack - Compromised user credentials - Automated attack tools successfully gaining access The correlation is performed by matching on the user email address to track attempts against the same account across multiple failed attempts and the eventual success.