The rule triggers when the average CPU utilization (AVG(CPU Util)) exceeds the device's CMDB critical threshold and there are at least two matching events within the 10-minute window.
Server A: Average CPU = (90 + 95) / 2 = 92.5, which is greater than its critical threshold of 90, and it has two events, so one incident is generated.
Server B: Average CPU = (70 + 60) / 2 = 65, which is below its critical threshold of 70, so no incident is generated.
So, Server A generates one incident, and Server B generates none.

The Windows parameter is set to 10, meaning FortiSIEM requires 10 data windows to build a valid training baseline. Since data is generated every hour, the device must collect 10 hours of data before producing a valid training set.

The query contains a nested query attribute type mismatch because the User attribute is being compared against a Device IP group value. The attribute type and referenced group type must match for the search to return results.

Setting the Evaluation Mode to Scheduled allows FortiSIEM to evaluate accumulated events over a defined historical period, such as 8 hours, instead of processing events only in real time through streaming evaluation.