Alerting for Unique Statistics Pairs

New OpenSearch user coming from ElasticSearch using ElastAlert as an alerting backbone.

In ElastAlert, we relied heavily on "new_term" type alerting rules for alerting on events such as malware, relying on new (not seen in 7 days) events with unique combinations of source and malware type.

Now that we've moved over to OpenSearch, we're trying to get a similar result from the built-in alerting, though seem to be hitting quite a roadblock.

I see that this is quite possible in visualizations using "[Unique count of source.ip]/[Unique count of threat.software.name]", though I've not been able to replicate this with alerting queries.

It's entirely possible that this does already exist and just requires broader knowledge, though if it does I've not been able to find any resources detailing how exactly one would go abouts actioning this.

If this is possible, could someone please provide an example query or a resource that details how exactly to build one, or alternatively if it doesn't exist, would it be possible to build alerting based on "unique" events into the regular alert options?

Start by reviewing the alerting query capabilities described in the issue and comparing them with the visualization's unique counts for source.ip and threat.software.name. Determine whether an existing alert query can express unique pairs; if not, define the required alerting behavior and provide either a documented example or a scoped feature proposal.