PropertyValue
http://www.w3.org/1999/02/22-rdf-syntax-ns#type
http://www.w3.org/ns/prov#value
  • Key off of: Class: dnsNode Attribute - LDAP Display Name dNSTombstoned Attribute - Value: Value: TRUE Operation Type: Value added The attribute view from ADSIEdit shows the 'dnsTombstoned' value = TRUE it is not seen in the screenshot but the attribute 'isDeleted' value is 'not set' ??? recall this record hasn't actually been deleted out of AD yet Here is a screen shot of an audit event from
http://www.w3.org/ns/prov#wasQuotedFrom
  • technet.com