:local srclist "30_sec_list"
:local countthreshold 7

# Internal processing ....
:local iparr ""
:local addr
:local count
/ip firewall address-list {
   :foreach l in=[find list=($srclist)] do={
      :set addr [get $l address]

#   unique IP
      :if ([:len [:find [:toarray $iparr] $addr]] = 0) do={

#       count IPs in list
         :set count [:len [find list=($srclist) address=$addr]]
         :put ($addr . " count: " . $count)
         :if ($count >= $countthreshold) do={
            :put ($addr . " exceeds threshold.  Do something here")
         }

#       append to array so this IP isn't counted again
         :set iparr ([:tostr $iparr] . [:tostr $addr] . ",")
      }

# foreach l
   }

# /ip firewall address-list
}

/ip firewall filter

add action=add-src-to-address-list address-list=24-hour-list address-list-timeout="1d 00:00:00" chain=bad-host-detection comment="If seen 20 time in 30 seconds add to the one day block list" disabled=no nth=50 src-address-list=30-seond-list
o