groups:
  - name: auth_failure_sum_by_ip
    interval: 5s
    rules:
    - record: job:auth_failure:sum_by_ip
      expr: sum(auth_failure_counter) by (ip)