Browse documentation
Reviewing audit events
ā© AD Audit
Once a domain controller is collecting, its events appear on the AD Audit page ā searchable, filterable, and available to alert on.
The summary
The summary reports volume and retention: which domain controllers are being audited, how many events arrived over the last seven days, how many have been ingested today, and how long events are kept ā logon events for a window you can set, change events for five years.
There is no daily ingest cap. Nothing is discarded for hitting a limit. What bounds this table is retention plus your plan's metered storage.
The events table
The Events table lists what's been collected:
| Column | Shows |
|---|---|
| Time | When the event occurred |
| Category | Account changes, Group changes, Computer accounts, Directory object changes, Logon, or Lockout |
| Action | e.g. Create, Modify, Delete, Enable, Disable, Add member, Remove member, Logon, Logon failed, Lockout (colour-coded) |
| Actor | Who performed it |
| Target | What was changed |
| Detail | The attribute and new value, or result status |
| Source | The source workstation/IP (for logons) or the DC |
Searching and filtering
The events view is a full search tool. The top bar has a search box (matches actor, target, or source host), a quick time range (last 24 hours / 7 days / 30 days, or a custom range), a Filters button, and CSV / Excel export.
Open Filters for advanced, combinable criteria (all must match):
- Category and Action ā tick any combination (e.g. Group changes + Add member).
- Domain Controllers ā limit to one or more DCs.
- Actor / Target / Source host / Result contains ā free-text field matches.
- Event IDs ā specific Windows Security event IDs (e.g.
4728, 4732). - From / To ā an explicit date range.
The newest events are shown first, in pages of 50 ā use Prev / Next and the "NāM of total" count to move through results. Clear all filters resets everything.
Event detail
Select any row to open a detail panel with every field for that event ā including the event ID, domain, old ā new values, the source DC, the Windows record ID, and the raw event message.
Exporting
CSV and Excel buttons download the current filtered results (not just the visible page) ā handy for ad-hoc evidence. For fixed, scheduled compliance exports, use the Reports module instead.
Search currently covers the recent (hot) event window kept in the database. Long-term/archived history is a later addition ā export what you need to keep, or use Reports.
Alerting on events
AD Audit can notify you when a sensitive event is collected ā for example, someone added to Domain Admins. Alert rules are managed in Settings ā AD Audit (admin only; or the Manage button on the AD Audit page). Add a rule with:
- A name.
- Optional match criteria ā category, action, target contains, and actor contains (all set criteria must match).
- A notification profile to notify through (email, Slack, Teams, a ticket, and so on ā see Notification profiles and recipients).
When a newly collected event matches, JOATOS fires the notification and records it in the alert history.
Compliance reporting
AD Audit's data also feeds the Reports module ā with reports for AD account & computer changes, group membership changes, and logon & lockout activity ā which you can view and download as CSV, Excel, or PDF.
Notes & tips
- Use target contains with a group name like Domain Admins to catch privileged-group changes specifically.
- Because it's a Pilot, the retention window on raw events is intentionally limited ā export anything you need to keep long-term via Reports.