A company runs a fleet of EC2 instances in a production VPC. The security team wants a managed service that continuously analyzes VPC Flow Logs, DNS logs, and CloudTrail events to detect threats such as compromised instances communicating with known cryptocurrency-mining domains or command-and-control servers. The solution must require minimal setup and must not require deploying agents on the instances. Which AWS service should the team enable?