An investigator needs to determine which Kubernetes identity deleted a Secret through the API. Which telemetry is the most direct evidence source when the relevant events were audited?

1. Only the application's stdout from an unrelated Pod
2. Only the container image's build timestamp
3. Only a list of current node labels
4. Kubernetes API audit events