Which type of data and analyses does Cisco Threat Defense collect to establish behavior baselines?

Which type of data and analyses does Cisco Threat Defense collect to establish behavior baselines?
A. raw
B. NetFlow
C. NBAR2
D. LAN Manager