A connector that previously supplied events has stopped. What should operations examine first?

1. Increase every alert threshold to hide the gap
2. Delete the connector's history
3. Connector health, source activity, credentials, collection configuration, and ingestion delay
4. Declare the environment safe because alerts decreased