A security analyst is investigating a multi-alert incident in the Microsoft Defender portal. The incident involves a malicious email that led to malware execution on several devices. The analyst needs to visually determine which mailbox first received the malicious message and how the threat spread to endpoints and identities, so they can identify the initial entry point. Which feature within the incident should the analyst use?