A company runs sensitive workloads on multiple Amazon EKS clusters. The security team wants to detect threats such as suspicious process executions, container escapes, and connections to known malicious IP addresses at the operating-system and container level inside the pods, in addition to the control-plane activity they already monitor. They want a managed solution that requires minimal ongoing agent maintenance. Which approach best meets these detection requirements?