A SOC correlation rule matches events from several systems, but device clocks differ by nine minutes. What should be corrected before relying on fine-grained event ordering?

1. The display order of dashboard widgets
2. Time synchronization and timestamp normalization
3. The length of the analyst's session timeout
4. The capitalization of device display names