{
  "name": "Card chargebacks",
  "description": "Chargebacks above the usual trickle, which is the first visible sign of card testing or a fraud run getting through",
  "query": "event_kind=chargeback earliest=-1h | stats count",
  "query_language": "spl",
  "condition_type": "threshold",
  "eval_interval_seconds": 300,
  "for_minutes": 0,
  "notification_target_id": "__TARGET_SECURITY__",
  "enabled": true,
  "comparator": "gt",
  "threshold_value": 8
}