Which three items are correct with regard to Cisco Security MARS rules?

The Cisco Security Monitoring, Analysis, and Response System (Cisco Security MARS) is an appliance-based, all-inclusive solution that provides unmatched insight and control of your existing security deployment. Which three items are correct with regard to Cisco Security MARS rules? (Choose three.)

A.
There are three types of rules.

B.
Rules can be deleted.

C.
Rules can be created using a query.

D.
Rules trigger incidents.