A custom detector should match a supported indicator in eligible cloud activity telemetry. Which approach best fits?

1. Create behavioral or prevalence-based detection using the available normalized telemetry.
2. Use appropriate Security Health Analytics or posture detection capabilities.
3. Reassess severity using indicator confidence, event semantics, and local impact.
4. Evaluate the supported Event Threat Detection custom-indicator capability.