...
https://spaces.at.internet2.edu/display/InCAssurance/Failed+Authentication+Counter+Strawman
Brett reported that University of Nebraska has a working proof of concept that's collecting the authentication failures, using Splunk as the aggregator.
They are working on excluding the authentication attempts for invalid account names. Good progress is being made.
...