An entity's risk score rises sharply. Analysts need to understand which events drove the change. Which approach best fits?

1. Compare prevalence with change records, ownership, and process lineage.
2. Verify event semantics and evidence of real execution or communication.
3. Inspect contributing detections and contextual evidence behind the score.
4. Correlate normalized events using stable identity and timing context.