Prisma Cloud: Why doesn't the "Excessive login failures" policy detect an alert?

Although the user tried many login failures, the "Excessive login failures" policy didn't detect any alerts.
Why doesn't the "Excessive login failures" policy detect an alert?

• Prisma Cloud Enterprise Edition
• Anomaly policy

• To trigger this alert, the user needs to perform failed login operations exceeding the threshold value followed by a successful login event within 15 minutes.
• In case there was no successful login event, the policy won't detect any alerts even if there were many failed login events in the 15 min interval.

• This policy captures IAM users console login events only.
• The login events from the command line operations with security tokens do not capture login events. Also the SSO login events are not normally generating audit events.