During an active incident, a SOC analyst confirms a compromised Windows workstation is exhibiting suspicious PowerShell activity that appears to still be running. The analyst needs to capture the current running processes, network connections, scheduled tasks, and autoruns as a single consolidated snapshot for the forensics team, without deciding in advance which individual files to retrieve. Which Microsoft Defender for Endpoint response action best meets this requirement?