I need to alert for 20 consecutive failed logon attempts within a 30 minute time period

We use these all the time.  Using $events.count as the return value:

Get-WinEvent        `
  -ErrorAction Stop `
  -FilterHashtable @{
      LogName   = $eventLog
      ID        = $eventID
      StartTime = (get-date).AddMinutes(-1*$timeSpan)
  }

(note the use of backticks for line continuation)

At the top of the script is this:

$eventLog  = 'Security'
$eventID   = 4625
$timeSpan  = 5

This allows easy cloning and quick set of the data being pulled… then you can set normal thresholds and heads/tails (consecutive polls to raise/lower the alert).