The SOC must prioritize limited ingestion capacity toward logs needed for its most important detection use cases. Which approach best fits?

1. Add observable error handling and retain appropriate rejected-event evidence.
2. Regression-test normalized output and affected detections before broad rollout.
3. Map detection requirements to telemetry coverage, value, and ingestion cost.
4. Measure ingestion delay and investigate the source-to-platform path.