Logs for when a feature was disabled

I'm wondering if there is a log for when a specific feature gets disabled - in this case Network Threat protection - I've gone through all the client managment logs and filted by "all" rather than 1 day, along with all NTP logs but nothing really corilates with the feature being turned off.

Thanks