[SkiFire13]

Rather than login failures I would monitor login successes. A sharp decrease of successes likely points to some issue, but an increase in login failures might easily be someone trying tons of random credentials on your website (still not ideal, but much harder to act on)

[Spivak]

Creating this metric/alert is practically a rite of passage for junior ops people who then get paged around 5pm.