During a proactive threat hunt in Microsoft Sentinel, an analyst runs a hunting query and identifies several suspicious PowerShell download events that are not yet tied to any alert or incident. The analyst wants to preserve these specific query results with investigative notes, share them with teammates, and later attach the findings to an incident for formal investigation. Which Microsoft Sentinel hunting capability should the analyst use?