FCSS_ADA_AR-6.7 · Question #13
Which two statements about phRuleWorker are true? (Choose two.)
The correct answer is A. phRuleWorker uses a 60-second bucket as an evaluation window. C. phRuleWorker exists on both the supervisor and workers. phRuleWorker processes events in 60-second intervals (buckets). This means that events within a one-minute window are evaluated together for rule conditions, helping detect patterns, correlations, and triggers. phRuleWorker runs both on the supervisor and worker nodes to…
Question
Which two statements about phRuleWorker are true? (Choose two.)
Options
- AphRuleWorker uses a 60-second bucket as an evaluation window.
- BphRuleWorker evaluates non-aggregate conditions as defined in subpattern filters of a rule in
- CphRuleWorker exists on both the supervisor and workers.
- DphRuleWorker exists on the worker only.
How the community answered
(42 responses)- A79% (33)
- B7% (3)
- D14% (6)
Explanation
phRuleWorker processes events in 60-second intervals (buckets). This means that events within a one-minute window are evaluated together for rule conditions, helping detect patterns, correlations, and triggers. phRuleWorker runs both on the supervisor and worker nodes to distribute event processing. The supervisor primarily orchestrates rule evaluation, while workers handle distributed event
Topics
Community Discussion
No community discussion yet for this question.