In Cortex XDR Prevent, which three matching criteria can be used to dynamically group endpoints? (Choose three.)