You are threat hunting suspicious traffic from a specific IP address. You nneed to annotate an intermediate event stored in the workspace and be able to reference the IP address when navigating through the investigation graph. What will you do?