An alert suggests data exfiltration, but a business team explains that the transfer may be an approved export. What is the best next step?

1. Approve all future transfers because this business team claims an export is expected
2. Classify the transfer only by its file size without checking authorization
3. Correlate authorization and transfer evidence before deciding incident status
4. Dismiss the alert solely on verbal reassurance