A tracked SmartEvent Candidate in a Candidate Pool becomes an Event. What does NOT happen in the Analyzer Server?
A.
SmartEvent provides the beginning and end time of the Event.
B.
The Correlation Unit keeps adding matching logs to the Event.
C.
The Event is kept open, but condenses many instances into one Event.
D.
SmartEvent stops tracking logs related to the Candidate.
I would say B is the answer as it relates to the correlation unit, not to the Analyter server…