Aggregations not implemented for this backend

[dubnik]

Hi,

I am trying to create simple sigma rule for cisco ios multiple failed logins. Playbook looks like this

title: Failed login Cisco IOS
status: Active
description: Detects failed logins.
author: PB
logsource:
  product: filebeat
detection:
  selection:
    event.code: LOGIN_FAILED
  condition:
   selection | count() > 3
  timeFrame: 1m
falsepositives:
- None
level: medium

but I get following error

An unsupported feature is required for this Sigma rule (/tmp/tmpk9ey8mlu): Aggregations not implemented for this backend
Feel free to contribute for fun and fame, this is open source :) -> https://github.com/Neo23x0/sigma

It's not possible to use count function in SO to alert only multiple failed logins in certain time.

Regards