A. Manually add a 'Chain of Custody' note to each incident after it's resolved.

B. Create a custom incident layout section. Within this section, define custom fields that use XQL queries (potentially leveraging 'lookup' functions against audit logs and incident history) to dynamically extract and display the detection timestamp, initial triager, and last modifier. Employ 'Field Transformers' or 'Renderers' to format the output clearly.

C. Develop an external application that exports incident data and generates a 'Chain of Custody' report.

D. Configure a playbook to email a summary of incident actions to a dedicated mailbox.

E. Train SOC analysts to remember and document these details in a separate ticketing system.