eDirectory moved from XDAS to using the Common Event Format (CEF) when Micro Focus acquired ArcSight
These values were obtained from empirical evidence and although believed to be accurate LDAPWiki could not verify from Micro Focus documentation.
| CEF CODE | eDirectory | Comment |
| CEF0290066 | QUERY_CREDENTIALS | If LDAP then Would also probably show as LDAP_SEARCH |
| CEF0290068 | QUERY_CREDENTIALS | If LDAP then Would also probably show as LDAP_SEARCH |
| CEF029006A | CHANGE_PASSWORD | If LDAP then Would also probably be shows as LDAP_PASSWORD_MODIFY |
| CEF0B0001 | CREATE_OBJECT | If LDAP then Would also probably be shows as LDAP_ADD |
| CEF0B0003 | RENAME_OBJECT | If LDAP then Would also probably be shows as LDAP_MODDN |
| CEF0B0006 | ADD_VALUE | If LDAP then Would also probably be shows as LDAP_MODIFY |
| CEF0B0007 | DELETE_VALUE | If LDAP then Would also probably be shows as LDAP_MODIFY |
| CEF0B0009 | DELETE_ATTRIBUTE | If LDAP then Would also probably be shows as LDAP_MODIFY |
| CEF0B0309 | DELETE_OBJECT | If LDAP then Would also probably be shows as LDAP_MODIFY |
| CEF0B0336 | ADD_MEMBER | If LDAP then Would also probably be shows as LDAP_MODIFY |
| CEF0B0337 | DELETE_MEMBER | If LDAP then Would also probably be shows as LDAP_MODIFY |
| CEF0B0354 | ACL_CHANGED | If LDAP then Would also probably be shows as LDAP_MODIFY |
| CEF0B0355 | LOGIN_ENABLED | If LDAP then Would also probably be shows as LDAP_MODIFY |
| CEF0B0356 | LOGIN_DISABLED | If LDAP then Would also probably be shows as LDAP_MODIFY |
| CEF0B0357 | INTRUDER_DETECTED | |
| CEF0B035C | LOGIN | If LDAP then Would also probably be shows as LDAP_BIND/LDAP_BIND_RESPONSE |
| CEF0B035D | AUTHENTICATE | If LDAP then Would also probably be shows as LDAP_BIND/LDAP_BIND_RESPONSE |
| CEF0B035F | ACCOUNT_UNLOCK | If LDAP then Would also probably be shows as LDAP_MODIFY |
| CEF0B0401 | LDAP_BIND | |
| CEF0B0402 | LDAP_BIND_RESPONSE | |
| CEF0B0403 | LDAP_UNBIND | |
| CEF0B0408 | LDAP_ADD | |
| CEF0B0409 | LDAP_ADD_RESPONSE | |
| CEF0B0412 | LDAP_MODIFY | |
| CEF0B0413 | LDAP_MODIFY_RESPONSE | |
| CEF0B0414 | LDAP_DELETE | |
| CEF0B0415 | LDAP_DELETE_RESPONSE | |
| CEF0B0416 | LDAP_MODDN | |
| CEF0B0417 | LDAP_MODDN_RESPONSE | |
| CEF0B0418 | LDAP_ABANDON | |
| CEF0B0424 | LDAP_PASSWORD_MODIFY |