What are three resources used in the Correlation phase of the event lifecycle?

A.
Rules, active channels, trends

B.
Dashboards, queries, filters

C.
Query viewers, active channels, data monitors

D.
Filters, rules,data monitors

Explanation:
http://www.triadsquare.com/training-programs/security-information-and-eventmanagement-siem/arcsight/aesa-esm-security-analyst(See the Learning Objectives Point #04).