A file hash appears in an intelligence report with limited confidence. What is the best investigation decision?

1. Validate the intelligence and correlate file prevalence, behavior, and affected assets
2. Declare every device containing the hash compromised without review
3. Ignore the hash because intelligence never helps
4. Delete all files with the same extension