When is it useful to schedule rules rather than have them run in real time?

A.
when you anticipate a worm or virus attack

B.
when events are occurring less frequently than usual

C.
when a network device is down

D.
when you need to minimize impact on system performance