How to think about threat detection in the cloud