I can see that adding documents to the briefcase is logged, and I'm quite happy that this is the case.

However, I see no logging of documents from the briefcase being accessed. While I do want my employees to have access to documents, at the same time, I do want to be aware if suddenly an employee starts transferring all documents to their home.

It could, after all, represent a hacked account, etc.

Any ideas on this? I'm already using logcheck to monitor for logins from external IPs, but I'd really like to parse for briefcase downloads too...