Contoso's security team wants Insider Risk Management to visually capture what a high-risk user does on their managed Windows device when they perform risky activities, such as exfiltrating files to USB. Before the team can create a forensic evidence capturing rule, which two prerequisite steps must be completed first?