A threat report describes a new attack technique without a reliable static hash or domain list. Which approach best fits?

1. Build behavioral hunt queries from the reported technique and available telemetry.
2. Document the visibility gap and avoid concluding the activity never occurred.
3. Narrow the time and entity scope according to the hypothesis and expand deliberately.
4. Escalate through the incident-response process while preserving evidence.