A hunt's query is expensive and covers years of data without a justified scope. Which approach best fits?

1. Narrow the time and entity scope according to the hypothesis and expand deliberately.
2. Document the visibility gap and avoid concluding the activity never occurred.
3. Escalate through the incident-response process while preserving evidence.
4. Build behavioral hunt queries from the reported technique and available telemetry.