What is a continuous protection feature of Advanced Malware Protection?

Behavioral Indicators of Compromise is a detection mechanism within AMP's continuous monitoring phase but is not identified in this context as the foundational continuous protection feature.

Sandboxing File Analysis (Threat Grid) is a point-in-time technique that detonates suspicious files in an isolated environment at the moment of detection, not an ongoing continuous protection method.

Global Threat Intelligence, powered by Cisco Talos, is a continuous protection feature because it is perpetually refreshed with real-time data collected from millions of global sensors, enabling AMP to continuously detect and respond to new and evolving threats - not only at the initial point of file inspection. This ongoing intelligence stream feeds retrospective analysis and behavioral monitoring, making it active before, during, and after a threat event.

File Reputation is a point-in-time lookup that evaluates a file's known reputation at the instant it is first encountered, not a continuously active protection capability.