Azure Arc agent is a software that enables you to manage your Windows and Linux machines hosted outside of Azure on your corporate network or other cloud providers. It allows you to project your existing non-Azure and/or on-premises resources into Azure Resource Manager

Explanation:
You should perform the following tasks in order:
On the Hunting page of Azure Sentinel, find the query you wish to clone.
Choose Clone query by clicking the ellipsis icon at the end of the row.
On the Create custom query page, make your edits then click the Create button.
First, you should find the query you wish to clone. You will do this by navigating to the Hunting page within Azure Sentinel and then looking through the list of queries. This will allow you to ensure the right initial query is cloned in the next step.
Next, you should choose the Clone query option. This is accessible via the ellipsis at the end of the row for the query you found in step one. This will make a copy of the query you identified in the first step and will take you to the page where you can make changes to that copy.
Finally, you should make your edits then click the Create button. These edits will be made on the Create custom query page, which is the page you are taken to after selecting Clone query in step two. This will allow you to tweak the copy to your needs. When you click Create, the initial query you copied will still exist in its original state, and a new query with the changes you make in this step will be generated/saved.
This process would allow you, for example, to alter the IP or hostname in the query to match your other domain controllers (DCs) but keep the rest of the query the same. As mentioned above, it also leaves the original query untouched/as-is. This is a fast, efficient way to make several queries that are related but require minor tweaks to meet the desired outcome. Starting each query from scratch would take much longer and would be more likely to result in human error in the query syntax.
You should not select New query on the Hunting page of Azure Sentinel. While this option could ultimately be chosen to generate the queries for your other DCs, as mentioned above, you would be starting from scratch. If you only need to change a few minor things in your query, going to New query is a waste of time as the clone option gives you a better starting point.
You should not select the ellipsis in the line of the query you want to modify, and select Edit query. This would allow you to edit an existing query, but it would not create a copy of it. Any edits made here would alter the original query. With the Clone query option, you leave the original unaltered, while efficiently creating new queries based on it.

In Microsoft Sentinel, parsing and normalizing happen at query time.
https://learn.microsoft.com/en-us/azure/sentinel/normalization-parsers-overview

Network transactions, Process and Command History are not collected. Only Prefetch files are collected.
An investigation package contains the following folders when you collect it from a device as part of the investigation process. These can help us identify the present state of devices and methods used by attackers.
Autoruns, installed programs, Network Connections, Prefetch files, Prefetch folder, Processes, Scheduled tasks, Security event log, Services, Windows Server Message Block (SMB) sessions, System Information, Temp Directories, Users and Groups, WdSupportLogs, CollectionSummaryReport.xls Reference:
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/respond-machine- alerts?view=o365-worldwide