Data acquired in a SOC usually has multiple sources. What would be the best approach to data acquisition?

a$.$ Acquiring relevant data within the boundaries of technical and compliance requirements

b$.$ Acquiring as much data as possible that would later be filtered out

c$.$ Considering first network devices as data sources, then progressively acquire data from other sour as the SOC matures

d$.$ Acquiring all possible data at first, then progressively reduce the data sources as the SOC matures