Samba and Linux audit trails, normalized into one investigable event stream with per-file history and rule-driven alerting.
Audit data is sensitive. Sessions expire after inactivity.