Contoso's security operations team wants to use Insider Risk Management to detect when users who have received security policy violations (such as installing unauthorized software or disabling security controls flagged by Defender for Endpoint) subsequently attempt to exfiltrate data. The team wants a policy template specifically designed to correlate security-related events with potential data risks, rather than focusing on HR-triggered departures or general leaks. Which Insider Risk Management policy template should you use?