What approach would be best for time series that tracked user generate some events (activitie is file creation - from 0 files per day - 18 files per day ). I determined that number of events per day follow negative binomial distribution and I used pseudo random generator to generate / simulate user behavior, but I don t know how to determine time of events(creation). Final goal is simulation of this user so if there is 4 events (user created 4 files that day) when in simulation that will be scheduled durring 24 h. Do I need to filter data in a way to have one data set 1 event/day, second dataset with 2 events/day and so on .. or some other approach.
SARIMA model https://autobox.com/pdfs/SARMAX.pdf identification is the answer following the ITERATIVE process here https://autobox.com/pdfs/ARIMA%20FLOW%20CHART.pdf . I strongly suggest that you consider approaches that allow for latent determinstic structure to be identified and incorporated as compared to freely available dated solutions that assume that there is no deterministic structure AND no outliers/pulses AND that the model parameters are constant over time AND that model error variance is constant over time.
The true Gold Standard of time series model identification includes an iterative process not just a single list-based presumptive approach that sometime is suggested here. Carefully ask and know the assumptions underlying all statistical tests . Read about A. Wald here https://medium.com/@penguinpress/an-excerpt-from-how-not-to-be-wrong-by-jordan-ellenberg-664e708cfc3d . A mathematician is always asking, “What assumptions are you making? And are they justified?”
Read closely the advice of @AdamO "The correlogram should be calculated from residuals using a model that controls for intervention administration, otherwise the intervention effects are taken to be Gaussian noise, underestimating the actual autoregressive effect." from Interrupted Time Series Analysis - ARIMAX for High Frequency Biological Data? . In layman's words don't over-trust or over-believe the acf/pacf if there are possible untreated deterministic structure in your data.