The Failed Login alert notifies you when its configured condition is met on SQL Server instances so you can investigate and respond.
Mini DBA describes this alert as: A connection was attempted to the SQL Server but the login was incorrect Mini DBA evaluates this alert once a minute so changes are detected quickly.
This alert helps administrators notice security-sensitive events before they become routine background noise. Failed authentication, expiring passwords, or audit issues can indicate access problems, misconfiguration, or active probing.
Enable it on production, shared, regulated, and externally reachable environments. You can use lower severity in isolated development systems, but keeping the signal visible helps catch account and permission drift early.
This alert is based on a state or event rather than a numeric threshold. Tune its schedule, scope, severity, and notification route so that the response matches the importance of the instance.
Review the affected principals, source hosts, and recent access changes. Rotate or unlock accounts only after confirming ownership, remove stale permissions, investigate repeated failures, and document any security exception with an expiry date.
If the alert creates repeated noise, review whether it is enabled on the correct instances, whether maintenance windows are configured, and whether the minor and major routes match the real business impact. Keep enough history to prove the new setting before changing it broadly.