please refer to the fraud sample : https://github.com/ishkin/Proton/tree/master/documentation/sample/fraud It demonstrates more complex situations and the appropriate definitions. The folder containts the description and explanation of the application: https://github.com/ishkin/Proton/blob/master/documentation/sample/fraud/SuspiciousAccountExample.pdf, and the appropriate artifacts.
On a high level - you need to define a temporal context, lasting 48 hours (you need to decide when this context begins - usually some initiator event indicates the beginning of the temporal window) and you need to define an EPA - if its just filtering out an event based on threshold it can be EPA of type "Basic" with a threshold condition.
