A model flags an unusual sign-in pattern. How should an analyst treat the anomaly?

1. As irrelevant because it is machine-generated
2. As a signal requiring context and investigation
3. As automatic proof of compromise in every case
4. As permission to destroy the user's device immediately