A security operations team has deployed Microsoft Sentinel and now wants to bring in security logs from their Microsoft 365 services, Azure activity, and several third-party firewall appliances so the data can be analyzed and correlated in one place. Which Microsoft Sentinel capability should they configure first to ingest this telemetry?