Data sources to be collected and reviewed during incident analysis might include:

A. DNS and whois records
B. Threat feeds
C. Application and system logs
D. Symptoms reported by users
E. A and C only
F. B and D only
G. None of the above
H. All of the above