Field Correlation of Events

Is there a way in a D&R rule to match on two different events using the with events: parameter if both events have the same field value?

For example, say I want to match a UserLoginFailed event followed by a UserLoggedIn event for a Microsoft 365 adapter, but only if the same user is in both events.

I don’t think that’s supported at the moment. :frowning:

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.