A new detection has not been evaluated against historical legitimate activity. Which approach best fits?

1. Test it against representative benign and malicious examples before broad enablement.
2. Add a narrowly scoped, reviewed exception with ownership and expiry.
3. Use relevant entity context and risk signals in prioritization.
4. Use an appropriately governed reference list.