Every environment is different, and some of the. The following table lists events that you should monitor in your environment, according to the recommendations provided in monitoring active directory for signs of compromise. All organizations should test these recommendations in their environments before creating alerts that require mandatory investigative responses.