# Event model

The Active Directory audit event model defines how activity in Active Directory is presented as clear, consistent, and actionable audit events.

## Overview

Active Directory does not provide a single, complete audit record for each action. Instead, information is distributed across multiple data sources, each contributing part of the overall context.

The audit platform combines this information into a unified event that answers the key questions:

- Who performed the action

- What changed or occurred

- When it happened

- Where it originated

- Target Object affected

- Old Value/New Value (for changes)

Each event is presented in a consistent format, regardless of how the activity was captured behind the scenes.

These enriched events form the foundation for timelines, investigations, and direct remediation actions such as rollback.

## Event sources

Audit events are built from multiple sources within Active Directory, each providing part of the overall picture:

### Directory changes

Provide authoritative information about what changed, including object updates and new values.

### Security event logs

Provide user and system context, such as who performed an action and authentication activity.

### Snapshot data

Provides baseline object state, enabling before-and-after comparisons and rollback.

These sources work together to produce a complete and reliable audit record.

## What an audit event looks like

Each audit event represents a fully correlated and enriched record of activity in Active Directory.

An event includes:

- Severity: Indicates the security importance of the event

- Detected Time: When the activity was observed

- Change Type: Create, Modify, Delete, or Authentication

- Actor: The user or system responsible

- Domain: The AD domain where the action occurred

- Target Object: The affected AD object

- Description: Human-readable summary of the action

- Before/After Values: For modifications (when applicable)

For example:

- A new user was created

- A user attribute was modified

- A directory object was deleted

This standardized structure ensures consistency across all event types and enables easy filtering, investigation, and rollback.

## Event categories

Audit events fall into the following categories:

### Change events

- Object creation, modification, and deletion

- Attribute updates

- Group membership changes

These are the primary focus of the auditing system and include full before/after context.

### Authentication events

- Logon successes and failures

- Kerberos and NTLM activity

These provide visibility into access patterns and potential attack signals.

## Noise reduction

Active Directory generates large volumes of routine activity, such as authentication traffic and background system operations.

The platform applies filtering and classification to:

- Reduce noise

- Highlight meaningful changes

- Prioritize high-impact events

This ensures that important activity is easy to identify without being overwhelmed by low-value data.

## Limitations

Some activities in Active Directory are inherently difficult to capture with full fidelity:

- Certain actions may lack complete user attribution

- Rapid successive changes may appear as a single final state

The system is designed to maximize visibility while maintaining performance and usability.

## Summary

The Event Model transforms fragmented Active Directory activity into:

- Clear, consistent audit events

- Complete context for investigation

- Actionable insights for security and recovery

By presenting all activity in a unified format, Commvault makes it easier to understand what happened, who was involved, and how to respond.

×

Loading...