Security needs a finding when a supported cloud resource becomes publicly exposed contrary to posture policy. Which approach best fits?

1. Reassess severity using indicator confidence, event semantics, and local impact.
2. Create behavioral or prevalence-based detection using the available normalized telemetry.
3. Use appropriate Security Health Analytics or posture detection capabilities.
4. Evaluate the supported Event Threat Detection custom-indicator capability.