How can I monitor authorizations on Server 2008 R2?

Question

System administration

Prompt any utility that can monitor authorizations on the 2008 R2 server, preferably those that did not pass.
I'll explain the situation. there is a server and one of these days it was hacked. Well, as they hacked, one employee somewhere blew the data for authorization. But after we logged in under it, the server was brute-forced with various logins/passwords for quite some time. Accordingly, it is displayed in the log. So, if there are any means to monitor this? For example, someone knocks on a server, authorization does not pass, a notification comes from the server to the mail, sms, but at least where?

Answer 1

I put a telegram notification on the failed login.
On a certain event in the log, a cmd script is launched, which, using curl, pulls a php script on the server that sends a notification to the telegram.
You can probably call bot-api directly from the script on the shell, but I already just have a php script that sends to telegrams, so it was easier for me to pull it.