ObjectSid attribute is not monitored by default, you need to do the following.
- Go to Administration Tasks
- Auditing > Attributes
- Choose User and on the bottom browse for objectSid under unmonitored attributes
- add it to the Monitored attributes > add
Now create the search as follow:
- create a new search.
- Under what tab press the down arrow next to add, and choose event class
- Look for ObjectSid under the Event class
- add it to the search
Additionally, you can set restrictions.
.png "image")
