A team begins a proactive threat hunt. What is the strongest starting point?

1. Define a testable hypothesis and confirm that available telemetry can evaluate it
2. Assume missing results prove absence of compromise
3. Disable ingestion to reduce the search space
4. Run an unrelated query and declare every row malicious