I can probably tackle this rather quickly. I already did part of this for a client last week, minus the alerting it was just to capture failed logins.