1. A non-transitory computer readable medium comprising instructions, which when executed by a processor perform a method, the method comprising: receiving a first captured communication; generating a first event data record corresponding to the first captured communication, wherein the first event data record identifies a source system of the first captured communication, a destination system of the first captured communication, and a first action to be performed at the destination system, wherein the first action is obtained from the first captured communication; identifying a first state of an operating domain, wherein the operating domain comprises at least one selected from a group consisting of the source system and the destination system, and wherein the first state is a current active state of the operating domain and is associated with a first state entry; making, using the first state entry, a first determination that the first action is not permitted while the operating domain is in the first state; based on the first determination, performing a state fault action; receiving a second captured communication; generating a second event data record corresponding to the second captured communication, wherein the second event data record identifies the source system, a second destination system in the operating domain, and a second action to be performed at the second destination system, wherein the second action is obtained from the second captured communication; making, using the first state entry, a second determination that the second action is permitted for the current active state of the operating domain; receiving a third captured communication; generating a third event data record corresponding to the third captured communication, wherein the third event data record identifies the second destination system, and a third action performed at the second destination system, wherein the third action is obtained from the third captured communication; and making, using the first state entry, a third determination that the operating domain can transition the current active state to a new current active state, in response to the third determination: obtaining a second state entry corresponding to the new current active state; updating the second state entry to indicate that the second state is the new current active state of the operating domain; and updating the first state entry to indicate that the first state is not an active state of the operating domain.