A security operations team uses Microsoft Defender XDR to protect endpoints, identities, and email. They also run Microsoft Sentinel as their organization-wide SIEM to correlate signals from Defender XDR, firewalls, and third-party cloud services. The team wants Defender XDR incidents and alerts to flow into Sentinel so analysts can investigate them alongside all other collected data in a single pane of glass. Which Sentinel capability should they configure to bring the Defender XDR data into Sentinel?