25 मार्च 2010 - There is an ArcSight rule that fires up at three failed logins. Then you can automate a report, every 24h that will list out all the accounts I think an active list is the correct way to go to track logon attempts over a long period of time. If you want to match failed logins to the same system, create an entry for .