RDP - brute force

I am looking for a way to monitor with nsclient++ if there is an error with the RDP service.
I see log 4625 in the windows event, but I can’t get the notification to send me after 5 wrong attempts.

Has anyone tried something similar?

thank you

but use with max_check_attempts=1 because of the the timecache