During an active multi-stage incident in Microsoft Defender XDR, your SOC team is following a shift-based handoff process. The analyst finishing their shift has completed initial containment (device isolation and user session revocation) but the investigation is not complete. Before logging off, the analyst needs to hand off context to the next-shift analyst directly on the incident so that the reasoning, actions already taken, and next steps are preserved as part of the permanent incident record for later review and reporting. Which action in the incident should the analyst use?