A hunter needs to reconstruct a suspicious account's actions across authentication, endpoint, and cloud sources. Which approach best fits?

1. Compare prevalence with change records, ownership, and process lineage.
2. Inspect contributing detections and contextual evidence behind the score.
3. Correlate normalized events using stable identity and timing context.
4. Verify event semantics and evidence of real execution or communication.