A security operations team has connected several data sources to Microsoft Sentinel and is receiving large volumes of raw logs. They want Sentinel to automatically correlate suspicious events and generate actionable incidents that analysts can triage. Which Microsoft Sentinel capability should they configure to accomplish this?