if possible deploy netflow V9
record ingress and egress
get NTA as well and then you can zoom into who, did what when and why
some of the guys who dio scriting should chime in here
otherwise just set of the veoews and same them as bookmarks for daily /weekly