Several alerts appear to be related parts of one attack. Why is incident correlation useful?

1. It groups related evidence and actions for coordinated investigation
2. It deletes all original evidence
3. It makes all response approvals unnecessary
4. It proves every grouped alert is automatically a false positive