Track file activity history

I need a full activity history for the folder Contracts/2026/Acme to answer procurement’s audit. Show who viewed, edited, commented, moved, or shared files in that folder over the past 90 days, with timestamps and the IP or location if available, and export it to a CSV for the legal team.

Before I hand this to legal, summarize the activity so a reviewer who dislikes raw logs can act: surface unusual events at the top (large downloads, shares outside the company, or deletes), mark repeated failed sign-in attempts, and highlight which user made policy-changing actions in the last 30 days.

Legal just asked for activity logs for the Acme contract folder and I see spikes of downloads last week that I don’t recognize. I’m afraid those were unauthorized or the result of a mis-shared link. I don’t know which accounts or shared links caused the spike. What’s the most likely diagnosis and the immediate steps to contain risk before legal digs deeper?

We repeatedly get audit requests because files have strange download spikes or unexpected external shares, which repeatedly rattles clients. Is the root cause usually over-permissive sharing, weak link expiry practices, or poor onboarding of new contractors? What single policy or checklist would prevent these recurrent surprises?