What are the supported aggregation types for risk attribution?