The role endpoint monitoring plays in detecting and prosecuting insider threats