A log source is accepted by the collector but events arrive hours late and weaken time-sensitive detections. Which approach best fits?

1. Map detection requirements to telemetry coverage, value, and ingestion cost.
2. Add observable error handling and retain appropriate rejected-event evidence.
3. Measure ingestion delay and investigate the source-to-platform path.
4. Regression-test normalized output and affected detections before broad rollout.