Threat_Hunting / Search endpoint/process/auth telemetry, test multiple hypotheses, pivot on hosts/users, document negative findings, and escalate only supported activity. · size 20 · threshold 4 · max attempts 3