Place the different phases of the incident response cycle into the order that they occur.

Preparation

Analysis

Detection

Post Incident Activity

Containment

Eradication and Recovery

Question $19(20$ points$)$

You are developing an incident response program and your CIO wants to know what type of log data you should collect. Provide your recommendations on three different types of log data you would collect and how it can be used for incident response. Your answer should explain why you chose each type of log data and should also explain how each type of data can be used.