A dashboard should help prioritize current investigation work rather than display every raw event equally. Which approach best fits?

1. Define measurable detection and response metrics with stable start and end events.
2. Monitor the notification and case-delivery path end to end.
3. Monitor and alert on ingestion health separately from threat detections.
4. Show actionable case status, severity, age, and ownership.