Following a critical security incident involving a potential advanced persistent threat, the security operations center (SOC) team at a large financial institution is reviewing FortiAnalyzer 7.0 logs. Initial alerts indicated a FortiGate firewall blocking traffic from a known malicious IP address. Shortly after, FortiAnalyzer flagged unusual outbound network traffic originating from a user\'s workstation to an external, unclassified IP address, and concurrently, a significant surge in failed login attempts was observed on the primary database server. Given the interconnected nature of these events, which of FortiAnalyzer 7.0\'s analytical capabilities would be most instrumental in accurately assessing the severity and nature of this multi-stage attack, moving beyond simple signature matching?