I receive alerts about possible intrusion events.

The account we set in ADAudit is the account being flagged.

Is there a log that I can view that shows when ADAudit accessed a server and directory at a specific time to verify this is legit activity?