Program execution on systems is watched and analysed continuously so that misuse of legitimate tools and utilities for malicious ends is detected.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.