A SOC analyst is triaging an incident in Microsoft Defender XDR that involves suspicious activity on a Windows server hosting the company's primary domain controller. The analyst notices that the automated investigation prioritized several lower-severity alerts on standard workstations before addressing this server. The security team wants Defender for Endpoint to give investigation and remediation weighting to this domain controller so that future automated investigations treat it with elevated importance. Which Defender for Endpoint configuration should the analyst apply to the device?