One user logs in from a new location, but legitimate travel is possible. Which approach best fits?

1. Investigate behavior and local context rather than dismissing it for lack of an indicator match.
2. Translate the hypothesis into testable behaviors and relevant telemetry queries.
3. Correlate sign-in context, device state, timing, and subsequent activity before classifying the behavior.
4. Search or retrohunt historical events for the indicator and investigate contextual matches.