We have an alert configured in our environment that is Failed login with
success.We want to refine this alert in a way that when multiple users
login is failed and other user is success from same host for event 4776
and 4624 Type 2, then only it fire...
