Does Excessive login failures also detected for switch role failures?

• Does Excessive login failures also detected for switch role failures?
• Is the recognition to detect regardless of account or role correct?

• Prisma Cloud
• Excessive login failures

Yes it will, because, SwitchRole is a type of login activity to switch from one role to the other possibly with elevated permissions. Failures from such actions should be treated the same way as the failures from ConsoleLogin events.
because, the anomaly policies that are predefined and marked as Prisma Cloud Default policies alert you to similar issue.

Below is the description of Excessive login failures for reference:

• Excessive login failures: Detects potential account hijacking attempts by identifying brute force login attempts from the management console or command line. This policy uses write events.

Below some of the anomaly policies for reference.

Excessive login failures: This policy also discovers insider threat detection such as

• Discover suspicious behaviors such as excessive login failures that could signal compromised accounts.
• Brute force attacks, and other behaviors that traditional security tools misses.