Alerting to real time users being locked out

[Sotu]

I am looking to build an alert that sends an email if someone locks themselves out of their Windows account after so many attempts.  I built a search out but when using real time I was bombarded with emails every few minutes which doesn't seem right.  I would to have the alert be setup such as if user x types the password in 3 times wrong and AD locks the account, send an email to y's email address.  Real time alerting seems to be what I would need but it bombards me way too much.

[ITWhisperer]

Real-time searches lock up cpus and should probably be avoided. You should ask yourself (and your users) how urgently do you need an alert? What is the maximum tolerable time between the event occurring and user y being sent an email? How quickly does y need to be able to react? Are they sitting waiting for the email to come in? How quickly does the notification get stale? Basically, buy yourself as much time as possible and then schedule your searches based on this, otherwise you will end up burning resources frequently checking for events that don't happen very often.