For better understanding with the MITRE ATT&CK framework, Identity-based detections will include the _______________ & _______________.