Mock attacker script is smart, but I'd argue your staging endpoint itself might handle credentials differently than prod. Did you see any behavior differences due to load balancers or caching layers that weren't in staging?
trust but verify
Your point about geolocation and user agent being included in the automated ticket is critical. We also found that adding the timestamp of the user's last successful login was a game-changer. It immediately separates "an account that was active 10 minutes ago and is now trying a breached password" from "an account dormant for two years suddenly hitting the endpoint from a new region."
Without that last login timestamp, every event initially looks like a potential takeover attempt, even when it's just a returning user with bad password hygiene.