author = "XXX XXX"

    description = "Detects a successful logon immediately following multiple failed logon attempts from the same IP or user, using specific Windows Event IDs."

    severity = "High"

    priority="High"

    mitre = "T1110.001"

    yara_version = "YL2.0"

    tactic = "Credential Access"

    technique = "Brute Force"

  events:

    // Event 1: Failed authentication attempts from Windows logs (4625).

    $fail.metadata.event_type = "LOGIN_FAILED" and

    $fail.principal.asset.ip = $ip_address and

    $fail.target.user.userid = $user_id

    // Event 2: A single successful authentication from the same IP (Windows 4624).

    $success.metadata.event_type = "LOGIN_SUCCESS" and

    $success.principal.asset.ip = $ip_address and

    $success.target.user.userid = $user_id

  match:

    $ip_address, $user_id over 5m

  outcome:

    $failed_attempts = count($fail)

    $alert_type = array_distinct("Successful Brute Force Attack via Event IDs 4624/4625")

  condition:

    $success and $fail and $failed_attempts >=3

}



Getting ERROR as 

• validating intermediate representation: placeholder variable fail is not assigned to an event field or outcome valueline: 40 column: 31-35 Line 40 is the outcome.Could someone please help me out where I'm making mistakes and what needs to be change.