Rolling Five-Minute Transaction Threshold

NICE Actimize monitors transaction activity for rapid bursts that may indicate suspicious behavior. Write a PostgreSQL query to identify users who exceed three transactions in any inclusive rolling five-minute window.

Requirements

1. Partition activity by user_id and order it by transaction_ts.
2. Count transactions from the current timestamp through the preceding five minutes, including both boundaries.
3. Return only users whose maximum window count is greater than three.
4. Include the earliest timestamp where the threshold was exceeded and the maximum transaction count observed.
5. Ignore rows with a missing user_id or transaction_ts, and sort results by user_id.