Managed MDR Fails to Alert on Password Spray Attack

An organization experienced a password spray attack targeting 16 users, including two admins, over a 4.15-hour period via their SSL VPN portal. The attack resulted in 271 unique password attempts, 3,600 failed logins, and over 300 account lockouts across 48 hours. Arctic Wolf MDR, which had access to the logs, did not generate an alert despite the activity being visible in the provided CSV data.