Create an alert on "Failure message: Strong Authentication is required"

Hi,

I would like to create an alert on "Failure message: Strong Authentication is required" when client IP is not from "France".

My idea is to find users whose password has been stolen, but where the attacker has no knowledge of MFA/TOTP.

I chose the following filter:

But I dont find how to filter only "Failure message: Strong Authentication is required" and after I would like to create policy on it.

Thank for you help!

Regards,

Lionel