Need advice on abnormal login auditing
Some steps to reduce these vulnerabilities can be found here:


  
  Disable the login that is being attacked. In most cases, the login would be a generic sa or admin account. This will disable access to the account. However, the server may still be vulnerable to outside attacks.
  Change name of the account that is being attacked. For instance, change the sa account to sa_databasename in order to make it harder to guess a high level account name.
  Change the port from the default 1433 to a random port in order to make it less predictable to find the port that the server is listening to.
  Change the firewall settings to only allow know IP addresses to get through the security system.
  Implement a strong password policy and make sure that the passwords expire on a frequent basis.