How would you design a response playbook for repeated failed logins followed by a successful login from an unusual IP?
