how to create threshold alert 10 failure login in 1 minute and send by email
1st you must know which "message ID" correspond to failed logins, you can use the graph mode event viewer or make a query on the correspond envision table for your LOG.
Then you have to make your alert rule, define/create the action output (email in this case) and finally activate your alert by manage view.
I hope it helps.
In the statement of the correlation rule (you have created), there would be arrow option available on top right. Just click on that and selectthe option "consider 10 events in 1 minute".
For the email notification, first you must have a output action as SMTP, if do not have then create one. Go to view and call your correlation rule there and click turn on the output action and there you will see the all output actions existed.
Retrieving data ...