This figure displays the three filters for the Failed Logins action. The three filters are:
action_name equals LOGON.
returncode doesn't equal 0.
time greater than "MM:DD:YYYY HH:MM:SS"