A tracked SmartEvent Candidate in a Candidate Pool becomes an Event. What does NOT happen
in the Analyzer Server?
A.
SmartEvent provides the beginning and end time of the Event.
B.
The Event is kept open, but condenses many instances into one Event.
C.
The Correlation Unit keeps adding matching logs to the Event.
D.
SmartEvent stops tracking logs related to the Candidate.
D
When a Candidate Becomes an Event
When a candidate becomes an event, the Correlation Unit forwards the event to the Event Database. But discovering an event does not mean that SmartEvent stops tracking logs related to it. The Correlation Unit will keep adding matching logs to the event as long as they continue to arrive during the event threshold. Keeping the event “open” condenses what might otherwise appear as many instances of the same event to one, and provides accurate, up-to-date information as to the beginning and end time of the event.
D. SmartEvent stops tracking logs related to the Candidate.