var loginRecords = engine.GetEventSource<Login>();

engine.AddQuery(() => from names in loginRecords.Stream
                        group names by names.Name
                        into logins
                        from login in logins
                        let next = logins.FirstOrDefault(t => t.LoginTime > login.LoginTime) 

                        let nextNext = null == next ? null: logins.FirstOrDefault(t => t.LoginTime > next.LoginTime) 
                        where
                          !login.Successful && (null != next && !next.Successful) && (null != nextNext && !nextNext.Successful) 
                          select login, HandleAlert);
