A capacity alarm fires every day during an approved batch workload and repeatedly obscures unrelated security alerts. What is the best operational response?

1. Automatically treat every future alert as a confirmed incident
2. Tune the rule using verified workload context while preserving detection coverage
3. Delete past alerts and leave the rule unchanged
4. Disable the entire monitoring service permanently