Large number of failed logins

New to SEM can someone help me to figure out how to get a rule created that shows failed logons by user account when it hits a certain threshold. I need to start auditing admin activity as well as group admin activity, does anyone know a way to generate alerts for admins venturing into areas they shouldn't be or something to that effect?