PixelRobots

SecurityEvent
| where EventID in (4625, 4624) and AccountType == 'User'
| summarize Attempts = count(), Failed = countif(EventID == 4625), Succeeded = countif(EventID == 4654) by Account

SecurityEvent
| where EventID == 4625
| extend Reason = case(
SubStatus == '0xc0000064', 'User name does not exist', 
SubStatus == '0xc000005e', 'No logon servers available to service the logon request', 
SubStatus == '0xc0000062', 'Account name is not properly formatted',