One of the Kaseya Sample Event Log Sets should cover this for you. The event set is called "ZC-CM1-E12 Security Logon Events" and it monitors the log for the following:

Source Category Event ID User Description

Security * 529 * *Unknown user name or bad password*

Security * 531 * *Account currently disabled*

Security * 532 * *The specified user account has expired*

Security * 535 * *The specified account*password has expired*

Security * 536 * *The NetLogon component is not active*

Security * 539 * *Account locked out*

Security * 627 * *Change Password Attempt*

Of course, you should be able to add a new Event Set to look for Event ID 539 to only monitor for Lock-Outs.  Good luck!

Best,

—TechJoe