When creating a case in Splunk SOAR, which action should be taken to correlate various findings (risk notables) to ensure all are actioned?