Your company runs 40 Azure VMs that send performance and event data to a single Log Analytics workspace. The operations team wants to be notified whenever any VM reports a critical Windows event with Event ID 41 in the past 5 minutes. You need to create an alert that evaluates a KQL log query against the workspace and triggers on matching results. Which type of Azure Monitor alert rule should you create?