event alerts based on time period

I've implemented this in the past as a dataSource for tracking number of failed connection attempts against a server over a 5 minute period.  Powershell that grabs the last 5 minutes of 4625 from the windows security log where the message contains the status for bad username or bad password.  It just returns a count rather than individual events.  This let me drive a NOC widget of devices to show brute force intrusion attempts.

This could potentially be added like a cluster alert using the existing eventSource though and help to combine individual events into a single actionable alert to reduce noise.

This is a super old thread, but I just came across it.... so I'll add my $.02