sum() - FinWatch

Signature: sum(<condition>, "<time_window>") Parameters: Same as count(). Return Value: A float representing the sum of the amount field for matching transactions. Description: Calculates the total monetary value of all matching transactions within the time window. Essential for detecting structuring (smurfing) or unusual outflow volumes. Example: High Outflow Detection

rule SourceHighOutflow {
    description "Source account has high outflow volume in 24h."

    when sum(when source == $current.source, "PT24H") > 5000

    then review
         score   0.5
         reason  "High cumulative outflow from source in 24 hours"
}

Variables count()