Alcatel Logon Failure Correlation

Version 1

    Just spent time working with a customer to try and bring the three (THREE!) different events that Alcatel generates to indicate a failure (including two successes, for some reason) to log in.  Hopefully the rule does some good for others out there.