Resolved! Some failed logins not triggering the "login failed" event.
Our security team is requesting a history of login attempts to our production instance. They want both the successful and failed login attempts.Since the event log only goes back a week or so, this is not suitable for their purpose. So I created ...