A hunt begins with a claim that stolen identities may access unusual resources after privileged sign-in. Which approach best fits?

1. Correlate sign-in context, device state, timing, and subsequent activity before classifying the behavior.
2. Search or retrohunt historical events for the indicator and investigate contextual matches.
3. Translate the hypothesis into testable behaviors and relevant telemetry queries.
4. Investigate behavior and local context rather than dismissing it for lack of an indicator match.