If you want to filter and analyze your audit data from AUD$ table you need to scan data using ACTION# column. It keeps information about audit actions but is NUMERIC columns. To find out meaning of the column check AUDIT_ACTIONS table

So using simple join between AUD# and AUDIT_ACTIONS tables filter data as you want

SELECT *
  FROM sys.aud$
 WHERE ntimestamp# > SYSDATE - 7
  AND action# IN (
        SELECT action 
          FROM audit_actions
        WHERE name IN 
          ('ALTER USER',
           'CREATE USER',
           'DROP USER'));

List of all audit actions

SELECT action, name 
  FROM audit_actions
ORDER BY 1;

Have a fun 🙂

Tomasz