the download audit entry which includes the browser download/cache as well as the more "traditional" user downloads. This is confusing for many users and creates a bunch of audit entries that grouped in the same bucket but are not the same.
at the simplest execution, we simply need to distinguish a preview or "View" from a "system download" or "Download" (i.e. downloaded a blob to a different location like local system of some other fileshare)
in the screenshot, you can see a customization to create something similar. the information is available as part of the extended info on a file. the information is located on the extended properties.