A SOC dashboard shows no detections from a source that stopped sending logs. Analysts assume it is safe. Which approach best fits?

1. Monitor the notification and case-delivery path end to end.
2. Show actionable case status, severity, age, and ownership.
3. Define measurable detection and response metrics with stable start and end events.
4. Monitor and alert on ingestion health separately from threat detections.