There is no good monitoring or alert functionality for dealing with potential invalid login attempts.

I suggest an alert setup to handle events when known users fail more than 3 times to login (either in Atlas or via driverlogin to db).

We have had an external audit done and this is something they have found as a shortage in the MongoDB Atlas environment.

Log files are good but not to monitor potential security issues