An analyst wants to query event records and find unusual activity that no current alert rule has identified. Which activity is this?

1. Storage compression
2. Threat hunting
3. Software licensing only
4. DNS delegation