During triage, an alert's IP indicator matches a shared proxy used by many employees. What should the analyst do before assigning a specific user as the source?

1. Treat the public IP as a unique workstation identifier
2. Assume the proxy administrator performed the action
3. Assign the incident to every employee equally
4. Correlate proxy, identity, and endpoint records to resolve the internal actor