Defender showing 3678 lockouts in the past 24 hours, yet I am receiving emails that there have been no lockouts.
Also, the Lockout time should be 1800 sec, but in the log the same IP is banned only for a minute.
Lockout occurred: Too many failed login attempts May 19, 2017 10:43 am 18.104.22.168
then I see
Lockout occurred: Too many failed login attempts May 19, 2017 10:44 am 22.214.171.124
And 3 pages more all 1 minute apart
The lockout threshold is 2 failed logins within 500 seconds and the lockout time is 1800 seconds