[Event] Criminal Allegation — 2026-03-22

120-day audit: 12,700 events, 12,395 suspicious (97.6%). Covers logins, admin actions, password changes, drive activity.