In the Audit Log you can filter when users loging was failed.
You can also do this with a query but is it possible to generate an automatic alert (Automatic Response) and that you get a direct signal when there is an attempt to login failed on the ePo Console ?
I though it was based on eventid 20790 , so i created an AR > epo notification event > eventid 20790 but i don't seems to work.
20790 seems to be an eventid of solidcore ?
Retrieving data ...