SmartEvent does NOT use which of the following procedures to identity events:

Matching a log against each event definition is a core step in SmartEvent's correlation process and is used to determine if a log qualifies as part of an event.

Creating an event candidate is a documented SmartEvent procedure that occurs after a log successfully matches an event definition.

SmartEvent does not use a 'local exclusions' matching step in its event identification workflow. The process involves matching incoming logs against event definitions, generating event candidates from matches, and then filtering those candidates against global exclusions. There is no separate local exclusions layer in the SmartEvent correlation engine.

Matching a log against global exclusions is a real SmartEvent step used to suppress known benign events from generating alerts.