A team wants lower-latency detections. What must it verify before choosing a near-real-time rule type?

1. That all alerts can be deleted immediately
2. Supported data sources, query capabilities, constraints, and detection requirements
3. Only the workbook's title
4. Assume every query and table is supported identically