During a threat hunt in Microsoft Defender XDR Advanced Hunting, you need to build a query that surfaces every file, IP address, and account that has been flagged as evidence across all high-severity alerts raised in the last 7 days, and correlate that evidence back to the specific alert title and detection source. You want to join two tables to produce this correlated result. Which pair of tables should you use, and on what key should you join them?