A security architect is evaluating endpoint tools for an enterprise. The team already blocks known malware effectively but repeatedly struggles to answer questions like 'What did this file do after execution?', 'Which other hosts were affected?', and 'Can we roll back or contain a compromised machine from a central console after the fact?'. Which class of solution should the architect prioritize to address these specific gaps?