Which three types of information could be used during the incident response investigation phase?

Which three types of information could be used during the incident response
investigation phase? (Choose three.)

A.
netflow data

B.
SNMP alerts

C.
encryption policy

D.
syslog output

E.
IT compliance reports