A budget alert reports unusual spending that may indicate compromised resources. What should the security workflow do?

1. Treat the budget alert as proof of a specific attacker identity.
2. Disable billing reports to remove the alert.
3. Correlate costs with Audit, identities, resource changes, and workload evidence.
4. Automatically publish all private data to recover the cost.