How capabilities chain together in one real incident. No single category sees the whole incident. An attacker steals a contractor’s session cookie. The EDR on the contractor’s laptop might spot the infostealer process. The IdP logs the token refresh. The CSPM reveals whether the target IAM role was over-scoped. The SIEM correlates all three streams so Threat Hunter Nyx can revoke the session at the IdP and isolate the host via EDR.