Key takeaway

ADR tells you how the attacker got in. DLP tells you what they took. Together, you get the two things you need most for breach response: verified root cause + precise impact scope. Without the correlation, your SOC is investigating two separate alerts that each tell half the story.