Get failed logon events 4771 and 4776, and return the TargetUserName and Workstation or IPAddress values recorded in the events.

Get-FailedLogonEvent.ps1

[CmdletBinding()]
param(
    [string[]]$ComputerName,
    [string]$SamAccountName
)

PROCESS {
    foreach ($computer in $ComputerName) {
        $events = Get-WinEvent -ComputerName $computer -LogName Security -FilterXPath "*[System[(EventID='4771' or EventID='4776')]][EventData[Data='$SamAccountName']]"
        foreach ($event in $events) {
            $UserName = ([xml]$event.ToXml()).Event.EventData.Data.Where{$_.Name -eq 'TargetUserName'}.InnerText
            if ($event.id -eq '4771') {
                $LogonSource = ([xml]$event.ToXml()).Event.EventData.Data.Where{$_.Name -eq 'IPAddress'}.InnerText
            } elseif ($event.id -eq '4776') {
                $LogonSource = ([xml]$event.ToXml()).Event.EventData.Data.Where{$_.Name -eq 'Workstation'}.InnerText
            }
            [PSCustomObject]@{
                Username = $UserName
                LogonSource = $LogonSource
            }
        }
    }
}