Ingestion time vs MTTD: avg() works in search but not in detection rules

Hello Community,

I successfully calculated average ingestion time using a SIEM search by comparing metadata.ingested_timestamp and metadata.event_timestamp, and aggregation functions like avg(), min(), and max() worked as expected.
 

metadata.ingested_timestamp.seconds > metadata.event_timestamp.seconds //excluding logs that have not Time in UTC
metadata.log_type = "OFFICE_365"   
$Timestamps = timestamp.get_timestamp(metadata.event_timestamp.seconds, "DATE")

match:
  $Timestamps,metadata.log_type, metadata.event_type, principal.namespace  // we can add or remove fields here to make it more specific or broad

outcome:
  $eventsCount = count(metadata.id)
  $avg_delay_minutes = avg((metadata.ingested_timestamp.seconds - metadata.event_timestamp.seconds) / 60)
  $max_delay_minutes = max((metadata.ingested_timestamp.seconds - metadata.event_timestamp.seconds) / 60)
  $min_delay_minutes = min((metadata.ingested_timestamp.seconds - metadata.event_timestamp.seconds) / 60)
  $bool = if($avg_delay_minutes > 15, 1, 0) //optional control

However, when I try to calculate MTTD using detection-level fields that are only available in the rule-writing context (for example detection.created_time and detection.time_window.start_time), I run into an issue.

Specifically, min() and max() are accepted, but avg() is not recognized when used on detection.* fields inside the rule outcome. The same function works correctly in  SIEM searches, but fails in this context.
 

rule MTTD {

  meta:
    author = ""   

  events: 
    $Rule_Name = $d.detection.detection.rule_name
    $Rule_Name = /AnyRuleName/
    $CreatedTime = timestamp.get_timestamp($d.detection.created_time.seconds, "SECOND")
    $WStartTime = timestamp.get_timestamp($d.detection.time_window.start_time.seconds, "SECOND")  
    $WEndTime = timestamp.get_timestamp($d.detection.time_window.end_time.seconds, "SECOND")      
    match:
       $Rule_Name  over 1h //, $CreatedTime, $Timing_details, $WStartTime, $WEndTime
    outcome:

  $max_delay_minutes = max(($d.detection.created_time.seconds - $d.detection.time_window.start_time.seconds) / 60)
  $min_delay_minutes = min(($d.detection.created_time.seconds - $d.detection.time_window.start_time.seconds) / 60)
  $avg2_delay_minutes = avg(($d.detection.created_time.seconds - $d.detection.time_window.start_time.seconds) / 60)

condition:
    $d
}

I am also not confident that detection.time_window.start_time.* is the most appropriate field to subtract from detection.created_time.* when calculating MTTD, so any guidance on the correct fields to use would be welcome.

Is this a known limitation of Chronicle rules ?
If so, what is the recommended approach for calculating MTTD in Chronicle?
should this be done outside the YARA engine (for example via exports or dashboards), or is there a supported workaround within rules/search?

Any guidance would be appreciated.