Hyper-V Cluster Failover Event viewer log showing SMB traffic connect to quorum disk network share

Hi,

To tweak my SIEM, I need to correlate smb network traffic between Hyper-V servers and witness disk stored on a network share on another server. I'm searching a log who tell me the Hyper-V is connecting to the witness disk (on network shared drive) for doing something ... probably I will be able to correlate and put exception when this happens and the SMB traffic between Hyper-V and the other server to stop always receive this alert.

Any cues would be appreciated!

Thanks