UA_failedlogin

COLUMN event_timestamp FORMAT A30
COLUMN dbusername FORMAT A20
COLUMN userhost FORMAT A20
COLUMN action_name FORMAT A30
SELECT event_timestamp, dbusername, userhost, return_code, action_name
FROM unified_audit_trail
WHERE action_name = 'LOGON' AND return_code != 0
AND event_timestamp > SYSTIMESTAMP - INTERVAL '24' HOUR ORDER BY event_timestamp DESC;