If there is a rule with a threshold 10 events, but only 2 events trigger for this alert, does the alert never fire? Or does it fire eventually with just 2 events?
No. The alert would never fire. If your threshold is set to 10, that means it will only trigger after the 10th failed login. However, you can easily tune the threshold number for a rule up or down if desired.