A detection engineer is building a YARA-L multi-event rule to detect data staging followed by a large outbound transfer within a 10-minute match window. During tuning, the rule fires reliably in test data but produces excessive alerts in production because legitimate backup jobs also perform large sequential file operations followed by network egress. The engineer wants to reduce false positives without abandoning the multi-event correlation logic. Which tuning approach is MOST effective while preserving the rule's detection intent?