A SOC wants to identify low-prevalence domains that do not appear in any existing threat feed. Which approach best fits?

1. Evaluate the supported Event Threat Detection custom-indicator capability.
2. Use appropriate Security Health Analytics or posture detection capabilities.
3. Create behavioral or prevalence-based detection using the available normalized telemetry.
4. Reassess severity using indicator confidence, event semantics, and local impact.