Audit Account Actions

Hello tpmobley,

It looks like you have the incorrect event type.  A new user event is going to show up as a NewDomainMember event, not a UserModifyAttribute event.

Additionally to answer your broader question, the LEM has template rules that will do a lot of this for you if you enable them:

Specifically "User Account Events" looks at the Auditable User Events group and looks for most of the event types you listed, or if you search for "user" in your rules section there are individual rules for most of the actions you're asking about.

Similarly if you wanted to track domain events for User Groups you can use the "Group Events" rule that will do about the same thing for the groups themselves.