The scenario describes a need for Extended Detection and Response (XDR) , which is the exact category created to solve the problem of "siloed" security tools.

Cross-Layer Correlation: Unlike EDR (which only sees the endpoint) or NTA (which only sees the network), Cortex XDR is designed to ingest telemetry from Network, Endpoint, and Cloud simultaneously. It uses "Log Stitching" to correlate these disparate indicators into a single timeline.

Scope of the Breach: Because XDR sees the entire path—from the initial network entry to the endpoint execution and the eventual cloud resource access—it allows analysts to see the "Full Scope" of a multivector attack that would otherwise look like isolated, low-severity events in individual tools.

Automated Response: Modern XDR platforms provide native, integrated response actions (like isolating a host or blocking a malicious IP across the firewall) directly from the investigation console, fulfilling the requirement for immediate action.

Why other options are incorrect:

SIEM (B): While SIEMs collect logs from many sources, they often lack the deep, native telemetry correlation (stitching) required to uncover stealthy behavior without significant manual rule-writing.

EDR (C): Restricted to endpoint data only; it would miss the network and cloud components of a multivector attack.

XSOAR (D): This is an orchestration tool. While it executes the response, it is not the primary engine for correlating and analyzing raw telemetry to detect the breach; it relies on a detection engine like XDR to feed it incidents.