If you haven't already, try looking for additional metrics you can enable in your policy. Assuming these are Linux guests, filter the object type on Linux. It looks like there are a lot of file server metrics disabled by default. I'm afraid I haven't used these myself so you might have to try enabling different ones. A lot of them are most likely for NFS servers, but there is a category "FileServer Mount" that might show what's mounted.
