When identifying anomolous downloads (ie potential data leakage), we utilise both Box Shield alerts and User Activity reports to establish details.

However, User Activity reports (csv, column E 'Action') do not differentiate between those documents and folders downloaded, and those that are 'Made Available Offline'. When attempting to avoid data leakage, the difference is important. Making content available offline is a legitimate task for users. However, large quantities of normal downloads may indicate fraudulent theft of data.

We need to be able to differentiate between the two types, as soon as possible

Because User Activity Reports record items as 'Download' when they are in fact documents/folders made available offline in Box Drive, it is not possible to identify and exclude the 'Make Available Offline' from analysis