A SIEM correlation rule fires when a single user account logs in from more than 3 distinct source IP addresses within 10 minutes. An alert triggers for a service account. The analyst notes the service account is used by a load-balanced application cluster with 8 nodes. What should the analyst do?

C is correct because a service account used by 8 load-balanced application nodes will legitimately authenticate from 8 different source IPs, matching the rule; proper tuning either excludes known service accounts or whitelists the cluster IP range to eliminate this specific false positive. A is wrong because locking a legitimate application service account causes an application outage without evidence of actual compromise. B is wrong because the analyst has context that explains the multi-IP logins as legitimate application behavior. D is wrong because permanently disabling the rule removes detection capability for actual credential abuse scenarios.