count() - FinWatch

Signature: count(<condition>, "<time_window>") Parameters:

Parameter	Type	Description
`condition`	Conditional Expression	A `when` clause that filters which transactions to count.
`time_window`	String (ISO 8601 Duration)	The lookback period (e.g., `"PT24H"` for 24 hours).

Return Value: An integer representing the number of matching transactions within the time window. Description: Counts the number of historical transactions that match the given filter condition within the specified time window. The count is then compared against a threshold using a standard comparison operator. Example: High Frequency Detection

rule HighFrequencyDestination {
    description "Unusually frequent payments to the same destination may require scrutiny."

    when count(when destination == $current.destination, "PT24H") > 10
     and amount > 100

    then review
         score   0.5
         reason  "High frequency of transactions to same destination in 24 hours"
}

How it works internally: The engine translates this into a SQL query against DuckDB:

SELECT COUNT(*) FROM transactions
WHERE destination = '<current transaction destination>'
AND timestamp >= '<now - 24 hours>'