We are only seeing user logoff events in the Authentication dashboard - there are no logons or failed login attempts etc.
Should these be under type=event?
We currently use Active Directory for authentication.
They should be under type=event and subtype=user
can you do a search in research and report app with query string fgt_auth? and see if there is any result about logon
