Customer problem :

• As a security analyst, I need to understand the precise cause of a monitored file change, including the process and user responsible, so that I can quickly investigate suspicious activity, troubleshoot issues, and maintain system integrity.
• As a security analyst I need to provide this information for auditing purposes