Aggregations in rules

[GyciakasGh0st]

We can find the way to do aggregations in SIgma rules. For example count event per 5 minutes and other type of aggregations.
In playbook it is possible:

Or we just not finding documentation? And if not yet possible to do that have you have plans for it ?

[cm-ops]

Think you are asking for correlations, that is currently not supported in SO. It is something the devs are aware of and will need to look at.