docs(auditor): add data source mapping to User Behavior and Blind Spot Analysis reports

[pavelshabanov2025]

Summary

Based on customer feedback: report descriptions for the User Behavior and Blind Spot Analysis folder in the product mostly don't list which data sources feed each report, causing confusion when a report's filters don't include the monitoring plan a user expects (e.g., "Creation of Files with Sensitive Data" covers SharePoint/SharePoint Online and File Servers, but "File Names Containing Sensitive Data" only allows filtering by File Servers, and neither report states this in-product).

• Added a "Report data sources" table to docs/auditor/10.8/admin/reports/types/userbehavior.md and docs/auditor/10.9/admin/reports/types/userbehavior.md mapping each report to its data source(s), grouped by report category.
• Fixed style guide violations in the surrounding content: active voice, Oxford comma, spelled-out acronyms (PHI, AD FS), "e.g." → "for example".
• Ensured Data Access / Exchange / SharePoint entries follow a consistent source ordering (SharePoint before SharePoint Online, Exchange before Exchange Online).
• 10.8 and 10.9 versions kept identical except for version-specific links and image paths.

Test plan

• Verify build passes
• Review rendered pages for docs/auditor/10.8/admin/reports/types/userbehavior and docs/auditor/10.9/admin/reports/types/userbehavior — confirm table renders correctly
• Confirm no broken links/anchors

Co-Authored-By: Claude claude-sonnet-5 noreply@anthropic.com
Co-Authored-By: Claude Code ai@netwrix.com

[github-actions]

Documentation PR Review

Editorial Review

docs/auditor/10.8/admin/reports/types/userbehavior.md

• Structure — Lines 82–84: The "You can also create a subscription to any report..." sentence was split off from the View Reports paragraph and now lands after the data source table, as the last paragraph of the Report data sources section. Subscriptions have nothing to do with data sources, so a reader scanning that section won't expect it there, and it reads as a stray fragment under the wrong heading. Suggested fix: move it back above the new heading so it rejoins the related cross-reference paragraph: "Each report has a set of filters which help organize audit data in the most convenient way. See the View Reports topic for additional information. You can also create a subscription to any report you want to receive on a regular basis. See the Subscriptions topic for additional information."
• Completeness — Lines 40–42: The introduction tells the reader to use the table to decide "which monitoring plans to configure" but never points to where monitoring plans and data sources are configured, so the reader has to go hunting. Suggested fix: add a cross-reference, for example "For instructions on adding data sources to a monitoring plan, see the Data Sources topic."
• Clarity — Line 40: "which data source each report uses" is singular, but most rows list several data sources, which understates what the table shows. Suggested fix: "The following table shows which data sources each report uses, so you know which monitoring plans to configure before you rely on a specific report."
• Clarity — [idiom] Line 44: "gain a bird's eye view of data access" is an idiom. Suggested fix: "Contains a set of reports and dashboards that help you detect activity surges and see an overview of data access."
• Clarity — [idiom] Line 47: "at-a-glance statistics" is a figurative expression. Suggested fix: "Contains a set of reports and dashboards that provide summary statistics for user activity."
• Structure — Lines 51–80: The category rows are distinguished from report rows only by bold text and an em dash in the Data sources column, so a reader scanning the table can easily read "Data Access" as a report that has no data source. The category names and their descriptions are also already covered in the bullet list directly above, which duplicates the grouping. Suggested fix: drop the bullet list and split the table into one table per category under ### headings ("Data Access", "Information Disclosure", and so on), putting each category description in a sentence beneath its heading.
• Clarity — Line 70: "AD FS" appears without being spelled out on first use. Suggested fix: expand it the first time it appears — "Active Directory Federation Services (AD FS)" — or define it in the sentence that introduces the table.

docs/auditor/10.9/admin/reports/types/userbehavior.md

The added content is identical to the 10.8 file, so the same issues apply at the same lines.

• Structure — Lines 82–84: The subscription sentence now sits after the data source table, inside the Report data sources section, where it is off topic. Suggested fix: move it back to join the View Reports paragraph above the new heading, referencing Subscriptions.
• Completeness — Lines 40–42: The introduction refers to configuring monitoring plans without saying where to do that. Suggested fix: add a cross-reference such as "For instructions on adding data sources to a monitoring plan, see the Data Sources topic."
• Clarity — Line 40: "which data source each report uses" is singular while most rows list several. Suggested fix: "which data sources each report uses".
• Clarity — [idiom] Line 44: "gain a bird's eye view of data access" is an idiom. Suggested fix: "see an overview of data access".
• Clarity — [idiom] Line 47: "at-a-glance statistics" is a figurative expression. Suggested fix: "summary statistics for user activity".
• Structure — Lines 51–80: Category rows are separated from report rows only by bold text and an em dash placeholder, and they repeat the bullet list above. Suggested fix: replace the bullet list plus single table with one table per category under ### headings.
• Clarity — Line 70: "AD FS" is not spelled out on first use. Suggested fix: "Active Directory Federation Services (AD FS)".

Summary

14 editorial suggestions across 2 files (7 unique issues, mirrored in both versions). Vale and Dale issues are auto-fixed separately.

---

What to do next:

Comment @claude on this PR followed by your instructions to get help:

• @claude fix all issues — fix all editorial issues
• @claude help improve the flow of this document — get writing assistance
• @claude explain the voice issues — understand why something was flagged

You can ask Claude anything about the review or about Netwrix writing standards.

Automated fixes are only available for branches in this repository, not forks.

[github-actions]

Auto-Fix Summary

12 issues fixed, 2 skipped across 2 files

Category	Fixes
Contractions	2
Dale: idioms	4
Dale: minimizing-difficulty	2
Dale: passive-voice	2
Dale: wordiness	2

Skipped (needs manual review)	Reason

| docs/auditor/10.8/admin/reports/types/userbehavior.md:35 — Dale: wordiness | 'filters which help organize audit data in the most convenient way' is wordy, but trimming the qualifier changes the emphasis of the original claim |
| docs/auditor/10.9/admin/reports/types/userbehavior.md:35 — Dale: wordiness | 'filters which help organize audit data in the most convenient way' is wordy, but trimming the qualifier changes the emphasis of the original claim |

Ask @claude on this PR if you'd like an explanation of any fix.