Which strategy should the administrator use to achieve this goal?

The Unusual protocol activity (Internal) network anomaly is generating too many alerts. An administrator has been asked to tune it to the option that will generate the least number of events without disabling it entirely.

Which strategy should the administrator use to achieve this goal?
A . Disable the policy
B. Set the Alert Disposition to Conservative
C. Change the Training Threshold to Low
D. Set Alert Disposition to Aggressive

Answer: C

Explanation:

Reference: https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-policies/anomaly-policies.html