Box Shield reports should have a button to trigger a User Activity report for the activities associated with the period of the Box Shield Alert - ALL actions (not just downloads).

This will assist in the investigation of downloads, and enable us to identify 'FALSE' shield reports - where downloads are in fact folders being copied or moved in Box Drive