The correct answer is D because Server A satisfies the rule’s threshold and count requirements, while Server B does not. The Study Guide explains that a FortiSIEM subpattern consists of Filter , Aggregate , and Group By components. It also states that the Aggregate function defines how many or what metric values must match during the time window, while Group By controls how the matching events are grouped into rows. The performance metrics lesson explains that FortiSIEM collects performance and availability data, converts polling results into logs, and uses those metrics for performance, availability, resource utilization, and baselining. In the exhibit, the aggregate evaluates CPU utilization against the device’s CPU critical threshold and also requires a matched-event count of at least two within the 10-minute window. Server A has CPU values above its critical threshold enough times in the window, so it generates one incident. Server B has a lower configured threshold but its collected CPU values do not satisfy the required aggregate condition for the grouped server. Therefore, only Server A generates an incident.