I opted to go with a WMI Event Sink rather than polling the Event Log. I've never done a benchmark to see which architecture would use less CPU, but I can say the WMI event sink causes nearly instantaneous reaction.
As an aside: I'd love to hear if somebody tries ts_block on Windows Server 2022. It works fine on 2012 R2 thru 2019 but I've never tried it on 2022.
If I ever bother to work on ts_block again I'm definitely going to implement all the features you added. (I'm aware you've already written the code but, for me, half the fun is writing the code. >smile<)
Windows Server 2012 R2 removed the IP address from the Event Log entry for failed RDP logons (to be fair, it's really that the just didn't include it in failed RDP logons when the TLS security layer is used-- reverting to the old RDP security layer in Windows Server 2012 R2 restores the IP address). Without doing something dodgy like trying to correlate closed TCP connections to Event Log entries there's no simple way to ascribe IP addresses to failed RDP logons on that version of Windows.
In Windows Server 2016 and 2019 Microsoft put the IP address back into the Event Log entry, restoring ts_block's functionality.