Renato, that's a question that's extremely difficult to answer in a forum post. I would suggest talking to the Sales Engineer that covers your account. They can either meet with you to show you how to respond, or direct you to the appropriate training resources (many of them are free!) to explain at a higher level how to deal with alerts of any type.
For this specific alert, I can offer that I see that trigger when NetWitness is first installed at a lot of customers. It's usually caused by misconfigured systems or expired passwords in your environment. The alert will contain links back to the individual logs that are categorized as login failures and those event logs will tell you what account(s) are involved and what systems are impacted. Then you can either fix the system (update the password, stop the requests, etc.) or whitelist that account in the rule itself.
