Watch this video on YouTube
During incident response, investigators are seeking evidence of anomalous or malicious behaviors related to the incident. What stage of IAM are they operating in?