A responder wants to reconstruct how an attacker first gained access. Which approach is strongest?

1. Use only the last visible alert
2. Assume the newest installed application caused the incident
3. Base the timeline on a guessed attacker nationality
4. Build a timeline from identity, endpoint, network, and application evidence