What is best practice when ingfesting Defender XDR Incidents and/or Alerts and using them for notables in Splunk ES? It seems like the Defender data is dynamic, so changes to Incident status and the Incident/Alert relationships may pose a challenge for being reflected as notables or in the ES Incident queue.
