Sending notification on unlawfull access attempt

Hi
I have created a notification that will send a mail based on certain
Administrator activities.

I just saw, in the logs that there was some attempts to log in to my one server.
Looking at my options when creating a notification, it does not seem possible
that I can add a condition like …

doc.operation=="Login" AND doc.status=="Failed AND doc.user NOT in{ ...list of all users }

Or is it perhaps possible ?