A SOC analyst in Microsoft Sentinel runs a built-in hunting query from the Hunting page that returns 40 results across several hosts. While reviewing the output, the analyst identifies three specific rows that show suspicious PowerShell execution worth preserving for a collaborative investigation later, but the activity does not yet warrant an incident. The analyst wants to retain these particular records, along with their mapped entities and notes, so other team members can pick up the investigation. What should the analyst do?