A suspicious binary needs enrichment without executing it on an analyst's production workstation. Which approach best fits?

1. Correlate identities, artifacts, timelines, and affected resources across available evidence.
2. Use approved artifact analysis and threat-intelligence services.
3. Isolate the affected endpoint using the approved containment procedure.
4. Revoke the compromised access path and investigate related activity.