Two analysts are handling related Sentinel incidents. What improves accountability and avoids duplicated response?

1. Mark every open incident as a false positive
2. Keep all findings in an analyst's private memory
3. Remove timestamps from investigation notes
4. Assign ownership and record status, evidence, and classification decisions