Detect failed MongoDB authentications:

- leakspeed of 20s, capacity of 5 on source ip
- leakspeed of 40s, capacity of 5 on source ip and unique distinct users
- leakspeed of 40s, capacity of 5 on source ip and unique distinct authentication database