Read for the question you need to answer

Start with the claim you are investigating. If the question concerns a service's access rules, read its dated policy documentation. If it concerns an analytical capability, look for the method, evaluation conditions, and limitations. If it concerns an incident, prioritize records that describe the actual affected assets and access.

These sources may complement one another without being interchangeable. A method paper can explain why an inference is possible but cannot prove that someone made that inference during a particular breach. Keep a short note of what each source establishes and where the remaining gap lies. That makes the eventual case summary easier to write accurately.

Sources

How sources are used

Source and citation policy