During triage of a high-severity multi-stage incident in the Microsoft Defender portal, an analyst notices the incident correlates alerts from Defender for Endpoint, Defender for Identity, and Entra ID. The analyst wants to use the embedded Microsoft Security Copilot to quickly understand how the attacker moved from an initial phishing foothold to domain-level access, including which accounts and devices were traversed. Which Security Copilot capability directly produces this narrative view of the attack progression?