RULE 1 HOURLY

-- All categories' hourly txns (ROLLING WINDOW) RULE 1
SELECT '2022' AS year, '5' as month, P.rule_name, P.status, 'MIN + FULL' as kyc, P.catg, 'Hourly' as Frequency, P.breaches FROM
  (SELECT Z.rule_name, Z.catg, Y.status, COUNT(DISTINCT Z.transaction_id) AS breaches FROM
        (SELECT 'HML_DISTINCT_MERCHANT_PAYMENT_WALLET_TXN_LIMIT' as rule_name, A.senderuserid, A.receiveruser, A.transaction_id, COUNT(DISTINCT B.transaction_id) as txns, IF(C.hml_category IS NOT NULL, C.hml_category, 'LOW RISK') AS catg, 
        CASE WHEN C.hml_category = 'HIGH RISK' THEN 5 WHEN C.hml_category = 'MEDIUM RISK' THEN 10 	  ELSE 15 END AS limit FROM
          (SELECT DISTINCT senderuserid, receiveruser, transaction_time as TxnTime, transaction_id
          FROM fraud.transaction_details
          WHERE EXTRACT(MONTH FROM updated_date) = 6 AND Year(updated_date) = 2022 
          AND workflowtype = 'CONSUMER_TO_MERCHANT' and sendertype = 'INTERNAL_USER' 
          AND errorcode = 'SUCCESS' AND pay_transaction_status = 'COMPLETED'
          AND wallet_flag = 'TRUE')A
        LEFT JOIN
          (SELECT DISTINCT senderuserid, receiveruser, transaction_time as TxnTime, transaction_id
          FROM fraud.transaction_details
          WHERE EXTRACT(MONTH FROM updated_date) = 6 AND Year(updated_date) = 2022 
          AND workflowtype = 'CONSUMER_TO_MERCHANT' and sendertype = 'INTERNAL_USER' 
          AND errorcode = 'SUCCESS' AND pay_transaction_status = 'COMPLETED'
          AND wallet_flag = 'TRUE')B
        ON A.senderuserid = B.senderuserid AND A.receiveruser = B.receiveruser AND ((UNIX_TIMESTAMP(A.txnTime) - UNIX_TIMESTAMP(B.txnTime))/3600) BETWEEN 0 AND 1 AND A.txnTime > B.txnTime
        LEFT JOIN
          (SELECT DISTINCT senderuserid, hml_category
          FROM fraud.hml_classification)C
        ON A.senderuserid = C.senderuserid
        GROUP BY A.senderuserid, A.receiveruser, A.transaction_id, C.hml_category)Z
    LEFT JOIN
        (SELECT DISTINCT eventdata_appliedrulesetid as rule_name, eventdata_mode AS status FROM foxtrot_stream.kratos_default
        WHERE eventdata_actions = 'BLOCK' AND eventdata_appliedrulesetid = 'HML_DISTINCT_MERCHANT_PAYMENT_WALLET_TXN_LIMIT'
        AND year = 2022 AND month = 6)Y
	ON Z.rule_name = Y.rule_name
    WHERE Z.txns >= Z.limit
  GROUP BY Z.catg, Z.rule_name, Y.status)P