A rule for administrative commands triggers heavily during an approved maintenance window. What is the best tuning approach?

1. Suppress every event from every administrator
2. Raise all severity labels without changing logic
3. Disable all administrative-command detections indefinitely
4. Validate maintenance context and narrowly tune documented expected behavior