A retailer runs a payment-processing microservice on a GKE cluster. The security team wants automatic detection of runtime threats inside running containers, such as a reverse shell being spawned or a suspicious binary that was added to a container image after deployment and then executed. Findings must appear alongside other cloud misconfiguration and vulnerability findings for triage. Which capability should the team enable?