A SOC wants to hunt for credential misuse that has not triggered an existing alert. What is the best starting point?

1. A requirement to find a compromise regardless of evidence
2. A dashboard screenshot without underlying events
3. A testable hypothesis tied to relevant telemetry and expected observations
4. A random export of all data without an investigative question