A rule update should remain traceable to the incident or threat hypothesis that justified it. Which approach best fits?

1. Restore the normalized field mapping and add detection-contract regression checks.
2. Measure coverage impact and replace it with a narrower evidence-based tuning change.
3. Version the rule with rationale, test cases, and an accountable owner.
4. Use supported grouping or deduplication with explicit entity and time scope.