A retail enterprise uses Microsoft Defender External Attack Surface Management (Defender EASM) to inventory internet-facing assets. The security architect must design a process so that newly discovered assets are automatically triaged by business unit and severity, and so that high-severity exposures (such as expiring certificates and CVE-linked assets) are pushed into the organization's existing ticketing system for remediation. The team wants to minimize custom code and rely on native or supported integration mechanisms. Which approach should the architect specify?