Presumably reading the SQL Error Log to find the failed logins is completely unrealistic in practice? (i.e. using xp_readerrorlog and having turned on Failed Login auditing for the instance)

P.S. I stumbled over this "Using SQL Server Extended Events to capture failed logins" half way down the page

http://www.sqlshack.com/using-extended-events-review-sql-server-failed-logins/[/url]