Structure a Snowflake Alert Definition

Claro's security team wants to be notified automatically when the number of failed login attempts in the past hour exceeds a threshold - a potential indicator of a credential stuffing attack targeting user accounts. The team is building a CREATE ALERT statement to detect this condition and fire a notification. Getting the clauses in the wrong order produces a syntax error.