How would you use network telemetry and endpoint telemetry together to confirm an intrusion at Vectra AI?