A hunt finds a rare process on a high-value server. The team needs to distinguish a newly approved tool from unauthorized execution. Which approach best fits?

1. Correlate normalized events using stable identity and timing context.
2. Verify event semantics and evidence of real execution or communication.
3. Compare prevalence with change records, ownership, and process lineage.
4. Inspect contributing detections and contextual evidence behind the score.