Inconsistent UBA Alert Generation for Multiple Failed Login Attempts – UEBA Standard

We are observing inconsistent UBA alert generation in our Netskope tenant for multiple failed login attempts to Naukri.com.

In one instance, an alert was generated when a user had 3 failed login attempts within approximately 15 minutes. However, in another instance, the same user had 10–20+ failed login attempts within just 6–7 minutes, but no alert was generated.

We would like to understand how Netskope UEBA detects and generates alerts for repeated failed login attempts.

• Is there a specific threshold or detection logic for this type of activity?
• Could the behavior differ depending on the application, browser, desktop client, or authentication method?
• Is this use case covered under the UEBA Standard license?
• Are there any known limitations or configurations that could explain this inconsistent behavior?

Has anyone encountered a similar issue or can share insights into how this detection works in Netskope?

Any guidance or suggestions would be greatly appreciated.

Thanks!