Identify and utilize appropriate data sources to support an investigation of a given security incident.
Examples: metadata, protocol analyzer output, syslog, rsyslog, syslog-ng