Your SOC team uses Microsoft Sentinel and wants to reduce ingestion costs on tables that provide little security value while also closing gaps in threat detection coverage based on the specific threats relevant to your environment. You want a built-in capability in the Sentinel portal that provides actionable, data-driven recommendations for both goals without building custom reports. Which feature should you use?