This figure displays the three filters for the Failed Logins action. The three filters are:

• action_name equals LOGON.

• returncode doesn't equal 0.

• time greater than "MM:DD:YYYY HH:MM:SS"