LEM Rule for Multiple Failed Logins using multiple account

Hi All,

I'm quite new on LEM and I want to make a rule that will give an email alert whenever multiple failed logins were detected from a single source IP that uses multiple account. I've tried searching on the template rules that is similar to this but cant find anything. Any help would be very much appreciated.

Thanks,