I have an alert setup that lets me know that there has been a certain amount of failed logins on a server, the thing is, it doesn't tell me where that failed attempt is coming from. A feature would be nice where we're alerted if it's an external attack or someone simply puts in the password wrong multiple times.