A manager wants to know whether logging covers the actions needed to investigate fraud. What is the best approach?

1. Retain only successful login events
2. Measure only total log volume
3. Map detection and investigation needs to event coverage and test representative scenarios
4. Assume a SIEM license proves adequate collection