A new parser change may alter fields used by existing detection rules. Which approach best fits?

1. Map detection requirements to telemetry coverage, value, and ingestion cost.
2. Measure ingestion delay and investigate the source-to-platform path.
3. Regression-test normalized output and affected detections before broad rollout.
4. Add observable error handling and retain appropriate rejected-event evidence.