A noisy rule alerts repeatedly on a documented approved scanner, but other scanners should still be detected. Which approach best fits?

1. Test it against representative benign and malicious examples before broad enablement.
2. Add a narrowly scoped, reviewed exception with ownership and expiry.
3. Use relevant entity context and risk signals in prioritization.
4. Use an appropriately governed reference list.