A suspected incident turns out to be an authorized maintenance action. What should the team do?

1. Disable all monitoring of that system permanently
2. Classify it as a confirmed breach to preserve statistics
3. Delete every record of the investigation
4. Document the disposition and use the evidence to improve detection and coordination where appropriate