A SOC is promoting a new cross-source detection rule. It must avoid misleading correlations and establish meaningful effectiveness. Which two validation activities are appropriate? Select 2 answers.

1. Test representative malicious and benign cases, including the intended time window.
2. Verify normalized field semantics and stable correlation identifiers.
3. Approve the rule solely because its syntax is valid.
4. Use a generic process name as the only identity key for all events.
5. Ignore parser changes because detection logic never depends on source normalization.