I am attempting to create an event filter and correlation rule to
identify when a users context has been changed. I moved a user object
to generate the event but I do not see anything except and ACL Change
that seems to have the information. What event should I be looking for
when an object is moved from one context to another?

Thank you.