A hunt identifies activity requiring further investigation. What should be captured in a Sentinel bookmark?

1. Only an analyst's first name
2. A replacement for all underlying log retention
3. Relevant query results and contextual notes linked to the investigation
4. A claim that every result is confirmed malicious