A SOC wants to correlate a suspicious cloud login with later object downloads. Which two fields are particularly useful when available? Select 2.

1. The dashboard background color
2. Normalized event timestamps
3. The alphabetic position of the alert title
4. The principal or session identity
5. The analyst's workstation wallpaper