What is the bug?
Importing a rule with aggregation throws an error.

It looks like `count()` is not supported, and OpenSearch requires `count(*)`, which is not consistent with Sigma syntax.

How can one reproduce the bug?
Steps to reproduce the behavior:

1. Go to 'http://localhost:5601/app/opensearch_security_analytics_dashboards#/import-rule'
2. Click on 'Create rule'
3. Switch to YAML editor
4. Paste the rule
5. Select "Create detection rule"
6. See error

What is the expected behavior?
Ideally OpenSearch should convert Sigma into a valid detection rule behind the scenes when the difference in syntax is known.