I just raised a WF Support Ticket to check if the audit logs are able to track if someone has downloaded a file and it would appear they don't...currently.
I'm looking for fellow admins to upvote this suggestion - we work with a number of client teams who handle sensitive documents and there has been a concern flagged that a user can log in from their own laptop to download files without going via VPN and would like to be able to monitor this type of activity
