The SmartEvent Correlation Unit (CU) is the core processing engine that creates events. It receives and analyzes logs from the Log Server (or Log Servers). Based on the rules defined in the SmartEvent Policy, the CU identifies and correlates related log entries into a single, actionable security event. This process transforms raw log data into meaningful incidents, significantly reducing the volume of data an administrator needs to review.

A. The Consolidation Policy is a set of rules within the overall SmartEvent Policy that the Correlation Unit uses to group logs; it is not the component itself.

C. The SmartEvent Policy is the configuration or rulebase that dictates how events should be created, but it is the Correlation Unit that performs the actual processing.

D. The SmartEvent GUI is the client interface used by administrators to view and manage events and policies; it does not participate in event creation.

1. Check Point R81.20 Logging and Monitoring Administration Guide, Chapter 3 "SmartEvent", Section "SmartEvent Components", Page 31: "Correlation Unit - The SmartEvent Correlation Unit analyzes logs from the Security Management Server... and identifies events."

2. Check Point Support Center, sk163413 "ATRG: SmartEvent": "The Correlation Unit (CU) is the 'brain' of SmartEvent. It is the component that reads logs from the Log Server, matches them against the Event Policy, and generates events."