What Logs Should an Application Server Retain in Order to Prevent

What logs should an application server retain in order to prevent phishing attacks while minimizing data retention?

A) Limited-retention, de-identified logs including only metadata.
B) Limited-retention, de-identified logs including the links clicked in messages as well as metadata.
C) Limited-retention logs including the identity of parties sending and receiving messages as well as metadata.
D) Limited-retention logs including the links clicked in messages, the identity of parties sending and receiving them, as well as metadata.