A SIEM alert combines failed logins, a successful login from a new location, and a new privileged role assignment. What should the analyst do first?

1. Rebuild every workstation immediately
2. Delete the new role before preserving any relevant context
3. Validate and triage the correlated activity
4. Close the alert because one login succeeded