When using a newly implemented security information and event management (SIEM) infrastructure, which of the following should be considered FIRST?

A. Report distribution
B. Encryption
C. Tuning
D. Retention