During investigation of a Defender XDR incident, you review a Microsoft Defender for Identity alert showing that an attacker who compromised a standard workstation account can reach a sensitive domain admin account. The entity graph displays a chain of hops through intermediate machines and accounts. You need to identify the exact route the attacker could use to escalate to the sensitive account so you can prioritize remediation of the weakest link. Which Defender for Identity capability should you use?