An analyst is investigating a potentially compromised endpoint within the network and pulls a host...

client applications by user, web applications, and user connections

number of attacked machines, sources of the attack, and traffic patterns

intrusion events, host connections, and user sessions

threat detections over time and application protocols transferring malware