SQL Statement

select count(*)
from dba_audit_session
where action_name = 'LOGON'
and returncode = 0
and timestamp > sysdate - 1/24

Description

If your Oracle database is configured for auditing, this alert will monitor for logon failures and alert the DBA group. It runs once every hour and looks for logon failures from the last hour.