Monitor end-user activity, keystrokes, and running processes on the endpoint based on DLP-related events for security investigations and auditing purposes.