Also, you may want to add UserLogonFailure.DestinationAccount is the same in the advanced threshold settings if you want the rule to trigger after 3 failed attemps by the same user account, if not it will trigger after 3 failed logons by any user in the group.
↧