Watch this video on YouTube
In an incident response process, which phase uses indicators of compromise and log analysis as part of a review of events?