Integrating custom detection with endpoint policies