CLIENT ENVIRONMENT SERVER INFRASTRUCTURE TELEMETRY EVIDENCE LAUNCH STRING DECRYPT ENV SCAN SUSPICION FLAG LOCAL EVIDENCE INTAKE CORRELATION THRESHOLD EVAL DELAYED VERDICT