A new rule produces many alerts from a known business process. What should tuning do?

1. Treat alert volume alone as proof of good detection
2. Suppress every alert from the entire organization forever
3. Validate the pattern, narrow conditions carefully, and test both false positives and missed threats
4. Delete the source telemetry