Best CIM data Model for User Activities Data

[manan_amin]

I'm trying to apply CIM model on User activity data. E.g. Session Activities,Process Activities,Network Activities

Which data model ( CIM ) best fit for this type of data ? 

P.S. I find Endpoint Data Model useful. is it correct data model ?

[richgalloway]

IMO, the events you describe are covered by separate data models. Authentication, Network Session, Endpoint, etc. Use the model that contains the events you need for the use case. It's possible to use more than one data model in a search.