How to create a complex detection rule (indicator + correlation)?

Yep, building block has been available from very early on.

To create an alert for each individual host, in addition to adding your domain field to group by, you can also add the host, with host.id or any other host-specific UUID. Group by allows multiple fields (as of 7.12 IINM)