A user with more than 5 logon failures within an hour

[Anonymous]

Could someone suggest a rule that I could use to create an alert?

[Anonymous]

[Anonymous]

Sorry just noticed you said hour (not minute), change the time window dropdown to hour. screenshot of the investigation window below:

Craig