A company's HR team notifies the security group that an employee has submitted their resignation. Management is concerned that during their remaining weeks, the employee may download and exfiltrate confidential product designs. The compliance team wants a solution that correlates HR data (such as resignation dates) with user activity signals to detect potentially risky behavior like abnormal file downloads before the employee leaves. Which Microsoft Purview capability should they use?