When using a newly implemented security information and event management (SIEM) infrastructure, which of the following should be considered FIRST?

A. Retention
B. Tuning
C. Encryption
D. Report distribution