groups:
  - name: auth_failure_alert
    rules:
    - alert: AuthFailureAlert
      expr: delta(job:auth_failure:sum_by_ip[30s]) > 10
      for: 10s