An incident in MARS is _______________.
A.
A series of raw message sent to the MARS viasyslog, SNMP
B.
A series of events that is correlated to represent a single occurrence using related information
within a given timeframe
C.
A series of events that triggered a defined rule in the system
D.
A series of behaviors in a session that describe an anomaly, worm or virus