# SIEM Visualization Example 2: Failed Logon Attempts (Disabled Users)

For this task we can create new dashboard

Create visual

Add filter event.code is 4625 = Failed logon attempt on a Windows system winlog.event\_data.SubStatus is 0xC0000072

Select windows\* Check for user.name.keyword in the left side

Select table type for visualization

Add rows field user.name.keyword number 1000

Add another host.hostname.keyword - 1000 Metric - count

Just save and return

Add another row to see the logon type winlog.logon.type.keyword - number 1000