Login With Limited Attempts

Hi.
I have security provider, login, restrict & logout setup working for me.
Now I have come across a use case where I need to allow limited number of unauthorized attempts.
The security login automatically sends back a 401 when login fails. How can I capture that in server action itself and run an update query to record a login attempt count, and then send a response back using a response step?