Can AI tell the difference between a bad password and a possible attack?

I built a simple AI SOC Analyst in Microsoft Foundry to see how it would interpret Windows Security events as the authentication pattern changed.

I started with normal activity:

4624 – Successful interactive logon → LOW

Then:

4625 – Single failed logon / incorrect password → LOW

Nothing surprising there. A single bad password is something we see all the time.

Next, I gave the agent five 4625 failed logons for the same account and workstation within 45 seconds.

5 × 4625 → MEDIUM

MITRE ATT&CK: T1110 – Brute Force

Then I changed the scenario again:

5 × 4625 failed logons → followed 10 seconds later by a successful 4624

Same account. Same workstation.

What interested me was that the agent kept the severity at MEDIUM.

From a Windows administrator’s perspective, I can see why. This could be password guessing followed by a successful attempt, but it could also be a legitimate user entering the wrong password several times and eventually getting it right.

The Windows events tell us what happened, but at this point they don't prove why it happened.

My next step would be to correlate the successful session with additional Windows evidence such as 4672 (special privileges), 4688 (process creation), PowerShell activity, account changes, and other activity following the successful logon.

This was a simple lab, but I think it shows an interesting use case for Microsoft Foundry in security operations: using AI to help with initial event analysis and investigation while keeping the final decision with the administrator or analyst.

For those working with Windows security or SOC operations: would you keep this at MEDIUM, move it to HIGH, or wait for additional evidence? What event would you check next?