PCI 10.2.7 - Create/delete system level objects. Having a sysadmin create and delete a file in /bin, /etc, but it's not showing up in PCI views (or in any regular views). Any tips or suggestions on how to get these events showing in the SIEM? Using 10.4 ESM.