[rules-users] Another solution for: Detecting more than 3 occurrences within 1 hour