An IDS flags suspicious traffic but does not block it. Which statement is correct?

1. Detection and prevention are separate capabilities
2. An alert proves a breach succeeded
3. The IDS replaces all incident investigation
4. An IDS always rewrites malicious packets