How does FortiSIEM update the incident table if a performance rule triggers repeatedly?

FortiSIEM changes the incident status to Repeated, and updates the Last Seen timestamp.

FortiSIEM updates the Incident Count value and Last Seen timestamp.

FortiSIEM generates a new incident based on the Rule Frequency value, and updates the First Seen and Last Seen timestamps.

FortiSIEM generates a new incident each time the rule triggers, and updates the First Seen and Last Seen timestamps.