SQL Server Audit Action Group:
FAILED_LOGIN_GROUP
This group allows you to track logon attempts to the server that fail. To track successful logon attempts see SUCCESSFUL_LOGIN_GROUP.
This is a server level audit action group only. It is not available in database audit specifications.
LOGbinder for SQL Server
events generated under this
Audit Action Group: