Data loss prevention with ONTAP file share - how to monitor ?

We're hybrid, most services have migrated to cloud except file shares.

It's a massive project to move to SharePoint, and we're not sure we want that as it would require transforming our security groups to 365 groups (which brings a whole lot of unwanted features).

Recently we noticed a usage spike on a particular user which has resigned and is working through his last days.

He totaled a few gigabytes of download from our ONTAP file share over a single hour. We presume he "stole" sensitive company data but can't prove it.

File access logs weren't enabled. We've since looked into enabling them. It creates an .evtx file which can be opened in event viewer. However the sheer amount of lines makes this hard to read.

We mainly deal with PDFs, thousands upon thousands.

What kind of log aggregator are we looking for to monitor suspicious usage ? Something that would be able to take this log and show me all instances at which file abc.pdf was opened. Or the number of files accessed per user ?

We've also since blocked external USB storage, and are looking to limit access to file sharing websites other than OneDrive.

Thanks in advance for your input