Agreation with sigma rules OS 2.4.110

[GyciakasGh0st]

Does some one found the way how to agregate with sigma rule ?

I tried simply to catch where user failed to logon 5 times per minute.

title: 'Windows failed logon(4625) 5 times per 1 minute'
id: ec9e3725-4037-4884-853a-a349c6c7e4f1
status: stable
description: Detects when there are multiple failed logon attempts (EventID 4625)within 60 seconds, regardless of target or source.
author: Name Surbame
date: 2024-12-13
references:

• https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
  logsource:
  category: security
  product: windows
  detection:
  selection:
  EventID: 4625
  condition: selection
  aggregation_key: user.name
  num_events: 5
  timeframe:
  minutes: 1
  level: high

But it catching all single events. Even then i press convert it return only " any where event.code:"4625" like it want only single events