First, you're going to have to make sure that the events are actually getting audited, as the LEM will only be able to record things that cause events.
Then you're going to want to make sure you're reading the Directory Service logs on your DC.
From there, we'd need to see sample events to help you create alerts, but I think that would at least get you seeing what you're asking about.