Account Creation Gauge used to indicate number of accounts created in a Windows environment. EventCodes (EventID’s) used are for server 2003/XP and newer. Modify the gauge to fit your environment’s needs.

sourcetype=WinEventLog:Security (EventCode=624 OR EventCode=4720) | eval NewAccount=case(EventCode=624, "New Account Created", EventCode=4720, "New Account Created") | stats count(NewAccount) as creation | gauge creation 1 5 15 25