Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.finwatch.finance/llms.txt

Use this file to discover all available pages before exploring further.

Signature: sum(<condition>, "<time_window>") Parameters: Same as count(). Return Value: A float representing the sum of the amount field for matching transactions. Description: Calculates the total monetary value of all matching transactions within the time window. Essential for detecting structuring (smurfing) or unusual outflow volumes. Example: High Outflow Detection 
rule SourceHighOutflow {
    description "Source account has high outflow volume in 24h."

    when sum(when source == $current.source, "PT24H") > 5000

    then review
         score   0.5
         reason  "High cumulative outflow from source in 24 hours"
}