A CAPTCHA is normally intended to ensure that 'user' input is from a real person.
While it could help to prevent automated attacks against a website login mechanism it is likely to negatively impact on the user experience (username, password and CAPTCHA) unless the system can be configured to only enable the CAPTCHA after one or two failed logins.
The alternative mechanism for controlling attacks without compromising on user experience is an access control policy on the website which includes a limit on the number of unsuccessful login attempts during a given period of time, followed by a lockout duration. This will help to defeat both automated and targeted (i.e. user-based password guessing attacks as well as automated attacks) so in effect you get 2 for 1.
Whether to impose a timed lockout (i.e. an automatic reset after say 10 minutes) or whether to lock the account and wait for the valid user to respond in some way is a judgment call based on the particular scenario i.e. things like data sensitivity, size of user population, number of help desk staff available etc.
Notifying the user of multiple failed logins could help to make the user aware of potential attempts of unauthorised access, but could also result in lots of unwelcome support calls, so set the bar at a level which works for you.