SharePoint & OneDrive monitoring
Know who touched which file, and when.
When a client's data leaks or an employee walks out with files, "we don't have logs for that" is the wrong answer. Lavawall® tracks opens, edits, downloads, shares, and deletions across SharePoint and OneDrive, attributed to the user, with timestamps.
Start my free trial, no credit cardSee how it works
User & file-level activity · external-share alerts · mass-download detection
Data movement, made visible
Every action, attributed
Opens, edits, uploads, downloads, moves, renames, deletes, restores from the recycle bin, permanent deletes, and version restores, over twenty SharePoint and OneDrive event types in all. Each event captures the actor’s UPN, client IP, file path, and site collection, a timeline you can hand to an auditor or investigator.
- Accessed / modified
- Uploaded / downloaded
- Moved / renamed
- Deleted / permanently deleted
- Restored from recycle bin
- Version restored
- Shared (internal & external)
- Permission changed
Risky shares, spelled out
Anonymous “anyone with the link” sharing, sharing to external email recipients, and adding external collaborators to a site all surface in the change feed, showing the file, the actor, the recipient, and the permission level granted (read, edit, or owner).
Mass-download detection
Lavawall® flags a user downloading many files in a short window from a site they don’t normally touch, with thresholds configurable per site collection. The breach-detection module raises a high-severity finding, the classic sign of exfiltration or a departing employee.
Kept past Microsoft’s window
Microsoft retains audit data for 90 days on E3 and 180 on E5. Lavawall® ingests on its polling cycle and retains for your full contract term, with export in CSV, JSON, and an evidence-bundle format for investigations.
Beyond SharePoint
Extend the same visibility to OneDrive, on-premises file servers, and Google Drive from one console.
Someone leaving with your files?
ThreeShield, the CISSP/CISA team behind Lavawall® preserves evidence and investigates data-theft incidents before the trail goes cold.
Common questions
- What file activity does Lavawall track?
- Opens, edits, downloads, shares (including external), permission changes, and deletions across SharePoint and OneDrive, attributed to the user, with timestamps.
- Can it catch an employee taking files before they leave?
- Yes, mass downloads and external shares over the last 60 days are visible, so you preserve evidence before disabling an account.
- Does it cover on-prem file servers and Google Drive too?
- Yes, on-premises file monitoring and Google Drive monitoring are available alongside SharePoint.