CloudTrail contains STS GetCallerIdentity events originating from OCI while authorized ODB provisioning occurs. How should the security team evaluate them?

1. Correlate them with expected forwarded access sessions used by the integrated service.
2. Delete the linked OCI tenancy immediately without investigation.
3. Disable all CloudTrail logging to prevent repeated events.
4. Assume all OCI-originated STS events prove stolen root credentials.