Your question is Windows Credential Dumping Telemetry Pipeline. Take a moment with it on the right.
Talk me through your thinking if you like. When you're confident, submit your answer and I'll grade it like a real screen (7/10 or better passes).
You're designing a security detection pipeline for Windows endpoint activity and need to decide which telemetry is worth collecting first. The goal is to capture the signals that best support reliable detection of credential dumping while keeping the pipeline practical to operate.
What telemetry sources are most critical when building a detection pipeline to identify credential dumping on Windows endpoints?