An incident contains identity and endpoint alerts for the same user. What should an analyst examine first to establish the attack sequence?

1. Close all alerts except the highest severity
2. Treat each alert as unrelated because sources differ
3. Only the most recently created alert
4. Correlated incident evidence, entities, and the timeline