A security analyst is triaging a high-severity alert on a critical production server. To understand the adversary ' s intent and technical execution within the framework of industry standards, the analyst refers to the console ' s categorization. Which specific methodology does CrowdStrike utilize within the Falcon platform to classify detections based on technical behavior?