Historical hunting returns no matches, but the relevant telemetry source was not collected during the suspected period. Which approach best fits?

1. Narrow the time and entity scope according to the hypothesis and expand deliberately.
2. Escalate through the incident-response process while preserving evidence.
3. Document the visibility gap and avoid concluding the activity never occurred.
4. Build behavioral hunt queries from the reported technique and available telemetry.