possibly useful;

malcomvetter/WhoDis
An example pattern in C# for watching security events (logon/logoff/privilege) - malcomvetter/WhoDis