On the specifc Rules 'Behavior' tab, configure the following:
Actions will fire when all selected conditions are true.
[*] Fire action if [3] consecutive evaluations are true
This should prevent the Alarm from evaluating a single sample and generating an alarm when only a single transient spike is detected in otherwise normal host/instance functionality. Examples: shortterm network latency, temporary spike in CPU/mem usage, etc. Typically the Foglight agent samples data betweeen 60s and 5 minutes apart.