Retrieve LEM logon attempt failures

Hi all

Is there a way to retrieve LEM logs(especially Logon attempt failures) from its database to any sort of format. the domain was hacked, so we want to see logon attempts from the past few days. Please help

Thanks