A detection should identify repeated behavior within a bounded time range rather than across the full retention period. Which approach best fits?

1. Use stable appropriate correlation fields and validate the joins.
2. Define the supported rule match window and aggregation conditions.
3. Write detection logic against the appropriate UDM field semantics.
4. Use a supported multi-event YARA-L rule with shared identity variables and a match window.