The rule is designed to trigger based on a specific number of events occurring within a defined time frame. The requirement is for three failed login attempts within three minutes. In FortiSIEM rule conditions, the "Time Window" is specified in seconds, so three minutes must be converted to 180 seconds (3 60). The "Aggregate Count" represents the number of events required to trigger the rule, which is three in this scenario. Therefore, the correct configuration is a Time Window of 180 seconds and an Aggregate Count of 3.

B. Time window 180 seconds, aggregate count 2: The aggregate count is incorrect; the rule would trigger after only two failed attempts, not the required three.

C. Time window 90 seconds, aggregate count 3: The time window is too short (1.5 minutes instead of 3 minutes), so the rule would not trigger for three events spread over three minutes.

D. Time window 90 seconds, aggregate count 2: Both the time window and the aggregate count are incorrect and do not meet the specified requirements.

1. FortiSIEM 7.2.0 Administration Guide

Page 338

"Defining Rule Conditions" section.

Time Window: "Enter the time window in seconds within which the events must occur." This confirms the requirement to convert the three-minute window into 180 seconds.

Aggregate on Count: "Enter the number of times the event must occur within the time window." This directly corresponds to the "three failed login attempts" requirement.