What are three resources used in the Correlation phase of the event lifecycle?
A.
Rules, active channels, trends
B.
Dashboards, queries, filters
C.
Query viewers, active channels, data monitors
D.
Filters, rules,data monitors
Explanation:
http://www.triadsquare.com/training-programs/security-information-and-eventmanagement-siem/arcsight/aesa-esm-security-analyst(See the Learning Objectives Point #04).