Is there any way to to detect rising of events count by 20% in 2 minutes according to previous 2 minutes interval?

[smi71]

I mean is it possible to describe using sigma rules?

[nasbench]

Please take a look at correlation rules https://github.com/SigmaHQ/sigma-specification/blob/main/specification/sigma-correlation-rules-specification.md

[smi71]

I'm already read it carefully but still can't figure out how to compare current counter with prevoius counter value.