“You have to get inside the running application and see it as it's running.”

Transcript evidence from Jeff Williams -- Application Detection & Response (ADR).