Reporting on disabled users attempting to logon

Hi all,

i have ana audit requirement to be able to report on the above. Every time try to define a filter for it, i get either all failed logons or events when users accounts are disabled..

help! fairly new to LEM but have it all setup and recording with agents and connectors setup collecting all the events.

thanks for any advise