Gemini Prompt for Hunting Anomalies in Security Logs

Top-load large log exports into <context> and place the analytical query at the bottom with an explicit bridging phrase.

<context>{{AUTH_AUDIT_LOGS}}</context> <task>Based on the information above, identify all IP addresses that triggered more than 10 failed MFA challenges followed by a successful session token issuance.</task>