Detect process status
Detect and trace data transfers at the endpoints
Detect anomalies and potential threats
Collection, Parse, Enrich, and Analyze