We have a Kiwi Syslog server for Centralized logging purposes.
Currently, our focus is only on monitoring, reviewing and reporting User Account/Password Violations.
We already used the necessary filters based on the event ID in this link - https://support.microsoft.com/en-us/kb/977519.
Now, our question is though we're already receiving the alerts. How do we identify alerts like Windows Event ID 4625 - "An account failed to log on" is related to a security attack/breach, or if they're just false alerts?