You identify an instance of a user in your environment utilizing a Cloudflared tunnel daemon, resulting in unusual command line activity. What steps would you t...