It doesn't state what it found suspicious as this can be for many reasons and overall uses a heuristic determination of what it considers might be suspicious and or if it should be allowed to run or is blocked.
Up to a point it does reflect what the application, etc. was doing, Modification of:, see image example of an entry in my log.
I have my behaviour shield set to Ask rather than Auto so that I control the any decision.