We have a similar setup:
(host=dc*) source=WinEventLog:Security (EventCode=4740) (Target_Account_Name!=localadmin OR user!=localadmin)
| eval Account=if(Target_Account_Name!=NULL, Target_Account_Name, user)
| eval Machine=if(Caller_Machine_Name!=NULL, Caller_Machine_Name, Caller_Computer_Name)
| fillnull Value="Unknown" Machine
| eval Time=strftime(_time, "%m/%d/%y %H:%M:%S")
| dedup Time, Account
| dedup Account, Machine
| table Time, Account, Machine
This will result in giving us the Time, Account, and Machine where the lockout occurred but it doesn't include the previous logs. We have it setup to then email our HelpDesk team inbox so they can reach out to the user (fortunately we are a small enough company this is reasonable).
... View more