Audit provides the following logon activity built in searches:

• AD FS All Active Directory Federation Services sign-ins in the past 24 hours
• AD FS All Failed Active Directory Federation Services sign-ins in the past 7 days
• AD FS All Successful Active Directory Federation Services sign-ins in the past 24 hours
• Logon Activity all authentication activity in the past 7 days
• Logon Activity all excessive Kerberos ticket lifetime events in the past 30 days
• Logon Activity all failed logon activity in the past 7 days
• Logon Activity all interactive logon activity in the past 24 hours
• Logon Activity all Kerberos authentication activity in the past 24 hours
• Logon Activity all Kerberos service tickets created with unsafe encryption type in the past 30 days
• Logon Activity all logon activity in the past 24 hours
• Logon Activity all logon session activity in the past 24 hours
• Logon Activity all NTLM version 1 logons in the past 7 days (Note: The associated event class is disabled by default in Change Auditor.)
• Logon Activity all remote logon activity in the past 24 hours