A compliance analyst at a financial services firm receives a Microsoft Purview Insider Risk Management alert indicating that a user copied a large number of files containing customer account data to a personal USB device. Before taking action, the analyst needs to review the sequence of activities, associated risk score, and supporting evidence for this specific user without exposing the user's identity to unauthorized reviewers. Which Insider Risk Management capability should the analyst use?