According to NIST-SP800-61R2, which option should be contained in the issue tracking system?

NIST SP 800-61 R2 recommends that the incident tracking system capture related incidents because linking correlated events helps analysts understand attack scope, patterns, and recurrence. Tracking related incidents allows the team to identify whether a single attacker or campaign is responsible for multiple events and informs containment and eradication strategies.

Unrelated incidents add noise and do not contribute to understanding the current incident's scope or root cause.

The tracking system documents incident handler actions, not actions by non-handlers, which fall outside incident response scope.

Public virus signatures are threat intelligence resources maintained separately and are not stored within the incident tracking system itself.