You can try the following:
Add Match component - define you criteria in here - Botnet Cat
Click on Parameters - set threshold to 5 events and TimeWindow to 10min
Then add a AND operator on the component and set the TimeWindow to 24H and tick the sequence box.
Thank you Japie
I did exactly what you mentioned but i didn't check on Sequence box which didnt allow me to set the time more than child .. now i click on Sequence box which allowed me to set the time to 24 hr ... Thank you very much for your response
it seems it didnt work for me.. i am able to see the events trigger only for 5 events in 10 min.. but not repetitive.
here it looks like..
AND [ 1. AND [ Filter --> Object_type In Botnet Category
1st AND - i have 24 hr with Sequence
2nd AND - I have 5 events in 10 min Interval.
If i select only one AND operator.. i can select only threshold and time window ( 5 event in 10 min interval) with sequence but not sure where to mention 24 hour time period.. Can you tell me if something is not right here.. Thanks..