[doofus]

To answer my own question, in the end I parsed the Combat log, first attempt, has not been tested, maybe there are more incoming damage categories.

-- pseudo code
"COMBAT_LOG_EVENT_UNFILTERED" 
   CombatLogGetCurrentEventInfo()


local function BA_AE_ProcessCombatLogEvent( current event info  )
  local playerGUID = UnitGUID("player");
  local timestamp, subevent, _, sourceGUID, sourceName, sourceFlags, sourceRaidFlags, destGUID, destName, destFlags, destRaidFlags = ...
  
  if ( sourceGUID ~= playerGUID and destGUID ~= playerGUID ) then
    return;
  end

  -- incoming damage
  if ( destGUID == playerGUID and destGUID ~= sourceGUID
  ) then
    local spellId, spellName, spellSchool;
    local amount = 0;
    if ( subevent == "SPELL_DAMAGE"
    ) then
      spellId, spellName, spellSchool, amount = select(12, ...)    
    end
    if ( subevent == "SWING_DAMAGE"
    ) then
      amount = select(12, ...);
    end
    if ( amount > 0 ) then
      local timeNow = GetTime();
      rawIncomingDamage[#rawIncomingDamage+1] = { amount, timeNow };
    end
    
  end
  
end

I basically store incoming damage amounts into an array which I then scan over a specific period of time to determine incoming damage.

local function BA_AE_IncomingDamage( timePeriod )
  local timeNow = GetTime();
  local incomingDamage = 0;
  for i = 1, #rawIncomingDamage do
    local timeRecorded = rawIncomingDamage[i][2];
    if ( timeNow - timeRecorded <= timePeriod  ) then
      incomingDamage = incomingDamage + rawIncomingDamage[i][1];
    end
  end
  return incomingDamage;
end