It looks like LEM gets data from these attempts, like this:
On the Authentication - User Log On Failure report, it looks like this:
You could create a custom report that only shows results with that failure reason, or a rule to alert off those events in LEM.