Tracking Windows Advanced Auditing in SEM

caltexleftright

Can someone run me through the basics on how to create a dashboard and widgets for specific event ID's that are tied to Windows Advanced Auditing categories and subcategories. I want to create a widget for identifying Credential Validation failures, event IDs 4776 and 4777. Thank you!

kellytice

@caltexleftright
OK, I'll try to answer it; please let me know if this is not enough or if you have specific follow-up questions.
This will be a bit detailed just to help others that aren't familiar with building filters and dashboard widgets in SEM.

First, it should be noted that SEM 2025.4 introduced the ability to have multiple SEM dashboards.
Basic info on creating a new dashboard is described here:
https://documentation.solarwinds.com/en/success_center/sem/content/admin_guide/new_in_6_8/sem-multiple-dashboards.htm

Populating that dashboard is possible by Editing the Dashboard and adding Widgets to it. For the most common widgets (Proportional Widgets like Pie Charts/Bar Charts), you'll want to first identify (or create) a FILTER that you can then use as the basis for your widget.

When you go into SEM and go to the Live Events tab, you'll see that there are a number of out-of-the-box filters on the left, such as All Events, All FireWall Events, Service Events, Group Changes, etc…
If you choose any of those filters you can see just the events that match the filter and then narrow down the result set even further by changing the timeframe (on the upper right of the page) and/or by searching for a specific text string (in the Live Search box, also on the upper right of the page).

But - you can also create your own filters so that you can find what you're looking for even more quickly…and that has the added benefit of letting you then create a Dashboard Widget based on that filter.

Another tidbit of information is that when you look at an event in SEM, the Connectors that SEM uses to parse ("normalize") the log data will always try to put the unique Event ID information into the field called ProviderSID.
So, in the screenshot below when I go look at an Event related to an Account Lockout, I can see that the Event Type is "UserDisable", the DestinationDomain field shows the domain as "AUS-VSR-SNG-103", and the Provider SID field has the text "Microsoft-Windows-Security-Auditing 4740" … so 4740 is the relevant EventID information for that Event.

So, let's say I want to create a Filter for the 2 Windows Event IDs that you mentioned: 4776 and 4777.
To start, I'll go to Live Events and on the upper left I'll click the plus sign at the top of the box to start a new filter.

If I want to narrow down this filter to specific EventTypes I could do that, but in this case I don't really care - or maybe I don't know - what the name of the EventType is - but I do know the 2 specific EventIDs that I'll look for instead.
So, I will 'shrink up' the Events section and I will expand Event Groups. Then I will click on "Any Alert" which basically means I am going to look at ALL the events. Once that is selected, I will drag the Provider SID field from the second column over to the right side of the screen and drop it by where it says "filter is true when". When you drag it over you'll want to make sure it is showing the blue line, which indicates exactly where it is going to be placed. That little bit of info will be more relevant when there are multiple entries on the right side, but even if you're just dragging one thing over you'll want to make sure you see the blue line:

Once I drop it there, I will click on the small box that says "drop item here, or add it" so that I can enter in the Event ID that I care to include in the filter. I'll put an asterisk around the EventID number to act as a wildcard, so if 4776 shows up in any part of the data in that field it will be matched and included in the filter:

Next, I will drag the same ProviderSID field over again and make sure I have the blue line, but this time I'll put in 4777 as the text to look for.
Once I add that second ProviderSID entry, it will show an AND operator, so I will also need to change that to be an OR instead by clicking the pink AND, then clicking OR instead:

Last step for the filter creation is to make sure to also give it a good name and then Save it.
So now I have a fully defined new filter called "Credential Validation failure Events":

which will show up as a filter in the User-Created section on the Filters pane:

Now that that exists, I can go to the Dashboard tab and click "Edit Dashboard" on the upper right of the page, then click "Add Widgets", and choose "*New Proportional Widget*", then click "Customize" on the bottom right:

Then I'll start editing the filter. First I will click on "Title and Description" to give it a name; I'll use the same name I used for the filter:

Then under "Filter and Property" and for the "Filters" field I will choose the filter that I previously made.
For the "Properties" field, I need to figure out what field I would like to use to 'break down' the data in a way that makes sense when I am looking at the widget. In the example we're currently in, would it make more sense to have the widget I am building list (for example) the Top 10 SourceMachine entries, or do I care more about breaking it down by the user name (which would most likely be in the DestinationAccount field) or do I just want to see a count of the count of 4776 events vs the 4777 events so I should choose ProviderSID instead? In my case, I'll choose SourceMachine

Under Chart Options, I can choose to display the data as a Pie, Donut, Vertical Bar, or Horizontal Bar. I'll choose Donut:

Once I save it, I'll have a widget alongside all the other widgets on the page! In my test environment here, I did not have any of the events matching the EventIDs you were looking for, so I get "no data to show" in my widget

but I'll build a very similar filter/widget using a couple of other events that I do have data for so that you can see a working example.
Here is my Filter:

Here is one section of the dashboard widget configuration where I chose the filter that I made:

and here is what the resulting widget looks like:

Note: instead of using the AnyAlert Event Group when defining my filter,
I could have used a different Alert Group like Auditable Events (All). In some cases I've had better luck doing that instead of using AnyAlert but tbh I'm not sure what the issue is that makes it work better in some cases :)