Threat intelligence identifies a newly malicious domain. Analysts need to know whether internal systems contacted it in retained historical telemetry. Which approach best fits?

1. Search or retrohunt historical events for the indicator and investigate contextual matches.
2. Correlate sign-in context, device state, timing, and subsequent activity before classifying the behavior.
3. Translate the hypothesis into testable behaviors and relevant telemetry queries.
4. Investigate behavior and local context rather than dismissing it for lack of an indicator match.