A possible active compromise emerges during a scheduled hunt. Which approach best fits?

1. Document the visibility gap and avoid concluding the activity never occurred.
2. Build behavioral hunt queries from the reported technique and available telemetry.
3. Narrow the time and entity scope according to the hypothesis and expand deliberately.
4. Escalate through the incident-response process while preserving evidence.