NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 Analyst

Rule aggregation is evaluated for each Host IP and Host Name group over the condition window. Server A has three matched events and an average CPU utilization of ((90 + 90 + 95) / 3 = 91.67), which exceeds its critical threshold of 90, so it generates one incident. Server B does not satisfy the CPU-utilization aggregate condition. FortiSIEM aggregate conditions trigger an incident only when the grouped event count and aggregate thresholds are met.