With DMARC, an aggregate report is a report combining a bunch of failed emails in one file. A forensic report is more detailed and will tell you about individual emails with their status.
In simple terms, an aggregate is more like a digest email. Forensic reports are sent each time your DMARC record catches an email.
We suggest using forensic reports (fo=1) because aggregate reports can be very long, which makes them harder to read.