A team creates an alert suppression for a legitimate recurring pattern. Which design is best?

1. Suppress all alerts from the product forever
2. Delete all prior evidence
3. Treat fewer alerts as proof that attacks stopped
4. A narrowly justified suppression with ownership, scope, review, and appropriate duration