A SOC needs evidence that a critical rule continues to work after ingestion and parser changes. Which approach best fits?

1. Include coverage and source-health context when interpreting alert trends.
2. Run appropriate detection health tests and monitor required field availability.
3. Measure verified outcomes and audit workflow behavior rather than trusting the close timestamp alone.
4. Attribute usage and quality metrics to accountable source owners.