After an incident is resolved, which activity best improves future response?

1. Measure success only by the number of closed alerts
2. Remove all incident records immediately
3. Keep a successful response procedure undocumented
4. Review root cause, detection gaps, and response decisions, then track improvements