What are three major features of StealthWatch? (Choose three )

StealthWatch establishes behavioral baselines for all hosts and users on the network, then uses machine learning to flag deviations that indicate threats such as insider attacks, data exfiltration, or lateral movement.

Malware clustering is a feature of Cisco Threat Grid (Secure Malware Analytics), which groups malware samples by behavioral similarity; it is not a StealthWatch capability.

StealthWatch collects NetFlow, IPFIX, and other flow telemetry from routers, switches, and other network devices, providing full network visibility without requiring dedicated probes or agents on every endpoint.

Data Loss Prevention is a distinct product category focused on content inspection and policy enforcement for sensitive data, which falls outside StealthWatch's network behavior analytics scope.

Real-time sandboxing is performed by Cisco Threat Grid or integrated AMP capabilities, not by StealthWatch, which focuses on flow-based analysis rather than file execution analysis.

The flow data retained by StealthWatch enables security teams to reconstruct historical network conversations, trace attacker activity, and investigate incidents long after they occurred, fulfilling a forensic investigation role.