windows login failure Arcsight correlation rules

High no. Of windows login failure for same username 

*Verify rule 

4. Action

3. Create Aggregration

2. Create condition

1.Create rule