Include further information within the anomalous download alert to show which application\service was used. Currently, this is only available from the user activity report, which takes a while to generate.

If the hostname and device type could be included, this would help decipher if anomalous downloads have taken place acorss multipe devices.