SQL Server Audit Action Group:
FAILED_DATABASE_AUTHENTICATION_GROUP
This group tracks logon attempts to a contained database that fail.
To track successful logon attempts, see SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP.
LOGbinder for SQL Server
events generated under this
Audit Action Group: