Can be used as a report or dashboard widget. (Sorry the Insert code button isn't working for me today)
SELECT TOP 100 AuditEventID, ToLocal(TimeLoggedUtc)AS LocalTime, --AccountID, CASE WHEN AccountID LIKE 'SPECTRUM-HEALTH\bob172736' THEN 'Bob Marley' WHEN AccountID LIKE 'SPECTRUM-HEALTH\WAY0834' THEN 'Will Smith' --WHEN AccountID LIKE '' THEN '' --WHEN AccountID LIKE '' THEN '' ELSE AccountID END AS [Name], AuditEventMessage FROM Orion.AuditingEvents Where AuditEventMessage like '%unsuccessful attempt to login%' ORDER BY TimeLoggedUTC DESC
