Which of the following should Ann use to gather the required information?

Ann, a CIRT member, is conducting incident response activities on a network that consists of several hundred virtual servers and thousands of endpoints and users. The network generates more than 10,000 log messages per second. The enterprise belong to a large, web-based cryptocurrency startup, Ann has distilled the relevant information into an easily digestible report for executive management. However, she still needs to collect evidence of the intrusion that caused the incident .

Which of the following should Ann use to gather the required information?
A . Traffic interceptor log analysis
B . Log reduction and visualization tools
C . Proof of work analysis
D . Ledger analysis software

Answer: B