An IT security manager has been alerted to a potential security breach in the company's network. An unknown user has been attempting to access restricted areas of the company's file server.

To track down the source of these unauthorized access attempts, the IT security manager decides to examine the relevant logs$.$

Which type of log should the IT security manager primarily focus on to identify the user behind these unauthorized access attempts?