Anomaly policies in Prisma Cloud utilize Network flow logs (A) and Audit logs (B) to identify unusual network and user activities. Network flow logs provide visibility into the traffic flow across the network, helping detect anomalies in communication patterns that might indicate malicious activities or network misconfigurations. Audit logs record user actions within the system, offering insights into potentially unauthorized or suspicious operations that could compromise security. By analyzing these logs, anomaly policies can effectively pinpoint irregularities that deviate from established baselines, enabling timely detection and response to potential security threats.