Endpoints with maximum number of malware threats rule for ArcSight

Please solve this rule I don't understand how to solve this.