An analyst is investigating a specific alert in Endpoint Standard. The analyst selects the investigate button from the alert triage page and sees the following:
Which statement accurately characterizes this situation?
A. These events are tied to an observed alert within the user interface.
B. The policy had no blocking and isolation rules set.
C. The events shown will all have the same event ID, correlating them to the alert.
D. Each event listed contributed to the overall alert score and severity.
