$rule_id = detection.detection.rule_id
$rule_name = detection.detection.rule_name
$date = timestamp.get_timestamp(detection.detection_time.seconds, "%F %T")
match:
  $rule_id, $rule_name, $date
outcome:
  $d_count = count($rule_id)
order:
  $date asc

A snippet of my results are above. I think this is what you are describing, in general with the exception that i don't have the same rule name on two different rules, but this is why i tend to prefer to use rule_id as a good value and then bring the name along for the human readable part.

 For the second part of the question,  let's revamp our query slightly. This time, we are moving the date out of the filtering statement and the match section and we are going to group on that same rule_id and rule_name but now we are going to return the max value of the detection by time and then use the get_timestamp function to make it nicely formatted. We will still count the number of detection in the past month by the rule_id and rule_name combination, but now in our results we have a single row for each rule_id/rule_name combo with the count of detections and the max detection time which would be the last time that rule triggered.

$rule_id = detection.detection.rule_id
$rule_name = detection.detection.rule_name
match:
  $rule_id, $rule_name
outcome:
  $d_count = count($rule_id)
  $date = timestamp.get_timestamp(max(detection.detection_time.seconds), "%F %T")
order:
  $date asc

Hope this helps!