If I am not mistaken, there is a Windows event generated on the AD domain controller whenever an unsuccessful authentication attempt or account lockout occurs. The most straightforward way to accomplish your use case would likely involve collecting the relevant event logs from your domain controllers and then alerting on the specific event(s) according to your needs.
