Monitoring Logoff/Logon Events for Anomalies

Sure... I'm using this as a datasource targeting isWindows() called "Active Directory Failed Login Count"

try {
    $events = Get-WinEvent                  `
        -ComputerName    ##system.sysname## `
        -ErrorAction     SilentlyContinue   `
        -FilterHashtable @{
            LogName   = "Security"
            Id        = 4625
            StartTime = (get-date).AddMinutes(-5)
        }                                  `
        | where Message -Match "0xC000006D"
} catch {
        $events = @()
}

"$($events.count)"

No warranty for the code, use at your own risk.  Please note the use of backtick line continuation for readbility.