A detection needs department and asset criticality context that is not present in individual authentication events. Which approach best fits?

1. Ingest and join appropriate entity or contextual data.
2. Validate the parser and mapping into the Unified Data Model.
3. Correct and test the parser mapping against representative source events.
4. Review and configure supported entity aliasing and identifier normalization.