SELECT '2022' AS year, Z.month, 'MIN + FULL' as kyc, Z.risk_catg, 'Hourly' as Frequency, SUM(IF(Z.txns >= Z.limit, 1, 0)) AS breaches, 'egvRedeemTxnCntHourly' as Rule FROM (SELECT A.user_id, A.txn_id, month(A.txnTime) as month, COUNT(DISTINCT B.txn_id) as txns, IF(C.hml_category IS NOT NULL, C.hml_category, 'LOW RISK') AS risk_catg, CASE WHEN C.hml_category = 'HIGH RISK' THEN 5 WHEN C.hml_category = 'MEDIUM RISK' THEN 10 ELSE 15 END AS limit -- CASE WHEN C.hml_category = 'HIGH RISK' THEN 10 WHEN C.hml_category = 'MEDIUM RISK' THEN 20 ELSE 25 END AS limit -- CASE WHEN C.hml_category = 'HIGH RISK' THEN 100 WHEN C.hml_category = 'MEDIUM RISK' THEN 150 ELSE 200 END AS limit FROM (SELECT DISTINCT user_id, transaction_id as txn_id, updated_at AS txnTime from egv.transaction_data where year = 2022 and operation like 'REDEEM%' AND response_code = 'SUCCESS' AND egv_transaction_state = 'SUCCESS')A INNER JOIN (SELECT DISTINCT user_id, transaction_id as txn_id, updated_at AS txnTime from egv.transaction_data where year = 2022 and operation like 'REDEEM%' AND response_code = 'SUCCESS' AND egv_transaction_state = 'SUCCESS')B ON A.user_id = B.user_id AND A.txn_id <> B.txn_id AND ((UNIX_TIMESTAMP(A.txnTime) - UNIX_TIMESTAMP(B.txnTime))/3600) BETWEEN 0 AND 1 LEFT JOIN (SELECT DISTINCT senderuserid, hml_category FROM fraud.hml_classification)C ON A.user_id = C.senderuserid GROUP BY A.user_id, A.txn_id, month(A.txnTime), C.hml_category)Z GROUP BY Z.month, Z.risk_catg