An information security manager is fine$-$tuning a Security Information and Event Management $($SIEM$)$ system in a company that has recently reported a series of unauthorized account access attempts. The manager wants to ensure prompt detection of similar incidents for immediate investigation. Which approach should the manager consider to optimize the system$$s alerting capability?

Enabling the SIEM system to send an alert for every received threat intelligence feed

Setting the SIEM system to generate an alert for every single$-$user login failure

Configuring the SIEM system to alert when multiple login failures for the same account occur within a specified time period

Arranging the SIEM system to archive all historical log data for retrospective incident and threat hunting