ASM-Dynamic Brute Force Protection

Hi,

Recently we had a brute force kind of attack where multiple login attempt made , the pattern is 3 request per second from 3 different ip's and the same ip's repeat after 20/40 minutes.. it goes on for an 2 hour or more. somehow we blocked it by geo control.. We have decided to create a ASM anamoly detection for brute force. does Dynamic Brute Force Protection prevent this kinf of attack? or do we have to create a custom made signature ? also we worried what if it triggered false positive. Pls let me know your thoughts.