What is the order in which the endpoint checks if a new program is safe?
1) behavioral threat protection, then local analysis, then WildFire query
2) local analysis, then behavioral threat protection, then WildFire query
3) WildFire query, then local analysis, then behavioral threat protection
4) local analysis, then WildFire query, then behavioral threat protection