Processes network telemetry and audit logs to detect infected endpoints, compromised cloud workloads, and emerging threats by analyzing anomalies and policy violations.