If you go to MANAGE > Nodes view of the web console, what is the status of the AD node? If you status is 'green', double click on the node and it should show you the list of enabled connectors. Security log should be one of the connectors that is enabled by default.
Also, can you check the license status of your LEM appliance (Go to MANAGE > Appliances view in the web console)