A security operations center (SOC) utilizing FortiSIEM 6.3 is investigating a series of seemingly isolated security alerts. These alerts originate from diverse sources: unusual outbound network traffic from an internal server, a series of failed authentication attempts on a critical application, and a suspicious file modification event on a user\'s workstation. The organization suspects a sophisticated, multi-stage attack that may involve novel exploit techniques not yet covered by existing threat intelligence feeds or signature databases. Which FortiSIEM detection methodology would be most effective in identifying the complete attack chain and its underlying malicious intent, given the potential for unknown attack vectors?