An incident in MARS is _______________.

A.
A series of raw message sent to the MARS viasyslog, SNMP

B.
A series of events that is correlated to represent a single occurrence using related information
within a given timeframe

C.
A series of events that triggered a defined rule in the system

D.
A series of behaviors in a session that describe an anomaly, worm or virus