An analyst at a SOC using Cortex XDR is overwhelmed by the sheer number of individual alerts generated during an active intrusion. According to the platform's design, which capability most directly reduces the number of separate items the analyst must triage while still revealing the root cause and sequence of events?