A security analyst at a retail company wants to proactively search across historical log data in Microsoft Sentinel to look for signs of undetected compromise before any alert is triggered. They plan to use built-in queries based on the MITRE ATT&CK framework to investigate suspicious patterns. Which Microsoft Sentinel capability supports this proactive investigation activity?