By pulling the events with the API and comparing them, it appears both are missing a share_level or similar attribute. This attribute is also they can detect when users share files outside the company.