Feature Request: Track by None

[OGSteve]

Per conversation with Da Beave, we should have a "track by none" option so that a single rule could be set to fire an alert after X amount of instances, regardless of the log source. For example:

In a ransomware event we might see multiple policy changes across an environment and so we would want to track by the event itself across an entire network rather than a single Domain Controller.