SELECT user_id, resource, COUNT(*) as attempts FROM audit_logs WHERE result = "blocked" AND event_type = "access_denied" AND created_at > datetime("now", "-${time_window} minutes") GROUP BY user_id, resource