Detects when a single user email experiences five or more failed Anthropic authentication events within one hour. Failures are matched by authentication category and outcome (for example magic-link or SSO login failures). The rule searches Anthropic audit logs (dataset anthopic.audit) for events with category containing 'authentication', outcome 'failure', and a non-null user.email, aggregates per email, and raises an alert when event_count >= 5. The detection window is a 60-minute rolling period, evaluated in 15-minute intervals. It maps the alert to MITRE ATT&CK technique T1110 (Brute Force) under the Credential Access tactic. The rule includes suppression by email for one hour to avoid duplicate alerts and provides detailed investigation fields (IP addresses, user agents, action values, and timestamps). The accompanying note and remediation guidance help triage based on IP diversity, successful logins from unfamiliar IPs, and correlations with related admin or IdP events. Potential false positives include normal expired-magic-link retries and IdP cutover tests during maintenance.