Which feature of AnyConnect provides customers the ability to monitor endpoint application usage to uncover potential behavior anomalies?

The Network Visibility Module exports endpoint flow data, including which applications are communicating, to a collector using the IPFIX protocol, enabling security teams to establish behavioral baselines and detect anomalies such as unexpected application activity or data exfiltration patterns.

Trusted Network Detection determines whether the endpoint is connected to a trusted corporate network and triggers VPN connection accordingly, but it does not monitor or analyze application usage.

Differentiated Mobile Access enables distinct access policies for mobile devices versus desktops, addressing access control rather than endpoint application behavior monitoring.

Secure Layer 2 Network Access provides authenticated, encrypted connectivity at the data link layer and is not related to application usage monitoring or anomaly detection.