A manager wants response staff to preserve a unified incident timeline across several tools. What is most important?

1. Only recording events from the tool that generated the first alert
2. Normalizing the timeline by overwriting original evidence timestamps
3. Only sorting events by message length
4. Consistent timestamps, reliable event sources, and documented decisions and actions