A newly ingested source appears in raw logs but key user and IP fields are absent from normalized security searches. Which approach best fits?

1. Ingest and join appropriate entity or contextual data.
2. Correct and test the parser mapping against representative source events.
3. Review and configure supported entity aliasing and identifier normalization.
4. Validate the parser and mapping into the Unified Data Model.