Error: Failed Login alerts are received for some specific domains.
Solution:
For Windows WMI monitoring, failed login alerts are received for some domains because Kerberos authentication is done first, followed by NTLM.
This can be avoided by providing the server name within the username field as shown in the below screenshot: