A security analyst is evaluating what visibility each monitoring technology adds to the SOC. The team already collects NetFlow and full packet capture, but they cannot easily see WHICH application (e.g., Facebook vs. Salesforce) is riding over TCP port 443. A manager asks which technology would provide Layer 7 application-awareness by identifying the actual application regardless of the port used. Which technology should the analyst recommend?