Every sign-in, and every failed one, is in the audit log. Five wrong passwords in a row lock an account for fifteen minutes.