A SOC analyst is triaging a high-severity multi-stage incident in Microsoft Defender XDR involving a compromised user account, suspicious sign-ins, and lateral movement to two devices. The analyst wants to use the embedded Microsoft Security Copilot capabilities to rapidly understand the full scope of the attack chain and receive a natural-language narrative that correlates the alerts, entities, and evidence across the incident. Which Security Copilot feature in the Defender portal should the analyst use first?