A Defender for Identity alert indicates suspicious on-premises directory activity. What should an analyst do next?

1. Delete the domain controller's logs before containment
2. Whitelist the account because it is privileged
3. Assume directory alerts cannot relate to endpoint incidents
4. Correlate involved accounts, directory activity, and endpoint evidence