IPS Signature to block SMTP Auth Failure

I receive a lot of SMTP Auth Failures at my exchange server and i would like to block them at the firewall using IPS. I tried fortinet's signature for smtp login brute force but i can not see any logs or any traffic denied by the policy.

Is anyone who accomplished this?