A manufacturing company runs a mix of Windows servers and legacy programmable logic controllers (PLCs) across several plants. IT and OT teams share responsibility. Corporate IT already uses Microsoft Defender for Endpoint on servers and workstations, and the SOC uses Microsoft Sentinel. The OT engineering team needs continuous asset discovery and threat detection on the PLC and SCADA networks without installing any agents on the control devices, while ensuring detections flow into the same SOC workflow. Which design approach best meets these requirements?