A. Configure a rule that flags file download events with the highest risk score, regardless of time frame.

B. Create a frequency-based YARA-L detection rule that assigns a risk outcome score and is triggered when multiple suspicious downloads occur within a defined time frame.

C. Configure a single-event YARA-L detection rule that assigns a risk outcome score and is triggered when a user downloads a large number of files in 24 hours.

D. Enable default curated detections, and use automatic alerting for single file download events.