A security engineer at a fintech company enables Amazon GuardDuty in the organization's management account. Two weeks later, GuardDuty generates a finding indicating that an IAM user made API calls from an IP address in a country where the company has no operations, and the calls attempted to disable CloudTrail logging. The engineer wants to understand which data source GuardDuty analyzed to produce this specific behavioral finding, so the team can validate the detection strategy. Which GuardDuty foundational data source was used to generate this finding?