CloudWatch

{($.userIdentity.userName = "consoleuser") && ($.eventName= "ConsoleLogin") && ($.responseElements.ConsoleLogin = "Failure")}