The reason you wouldn't want to look at XO for this from a technical standpoint is because XO works at the hardware level of the hypervisor, dolling out resources to different VMs and creating backups.
You need to look at the content within a given VM and compare the file system difference from points A and B.
Only something that is operating within the file system would be able to readily tell you "Something has changed".
Odds are you have a user or several who are dumping files onto a share that they shouldn't be, or are replicating some cloud service to keep a copy on your server etc.