Rolling 30-Day Threat Detection Averages

Given a table of security events, write a query to calculate rolling thirty-day averages of threat detections per organization.

Treat event_type = 'threat_detection' as a threat detection. Calculate daily results for dates with events, exclude events without an organization, and use a calendar-based thirty-day window including the current date.

Output

1. One row per organization and event date, with organization_id, event_date, daily_threat_detections, and rolling_30_day_average
2. Include all event dates, including dates with zero threat detections
3. Order by organization_id, then event_date