@Jeff Singleton since a failure to login is an event and not the state of something at a point in time, this will be in an events table. You will most likely find what you are looking for in user_events (Mac/Linux), or in windows_events if you are looking for specific Windows Event IDs for that