A network administrator is tasked with enhancing the detection of insider threats and sophisticated malware on a segmented corporate network protected by FortiGate firewalls. The administrator has configured FortiAnalyzer for centralized logging and reporting. During a routine review, an alert is generated indicating a workstation exhibiting an atypical pattern of high-volume outbound connections to a newly registered, geographically distant IP address range, using an unusual port. Which FortiAnalyzer feature, in conjunction with FortiGate logs, is most instrumental in identifying and flagging this specific type of anomalous user and device activity?