# Field Correlation of Events

**URL:** <https://community.limacharlie.com/t/field-correlation-of-events/532>\
**Category:** Support\
**Created:** [November 14, 2025, 10:42pm UTC](https://community.limacharlie.com/t/field-correlation-of-events/532 "2025-11-14T22:42:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![quic](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/quic/32/254_2.png) [@quic](https://community.limacharlie.com/u/quic)\
**Post date:** [November 14, 2025, 10:42pm UTC](https://community.limacharlie.com/t/field-correlation-of-events/532/1 "2025-11-14T22:42:41Z")

</div>

Is there a way in a D&R rule to match on two different events using the **`with events:`** parameter if both events have the same field value?

For example, say I want to match a **`UserLoginFailed`** event followed by a **`UserLoggedIn`** ` `event for a Microsoft 365 adapter, but only if the same user is in both events.

---

<div class="post-metadata">

**Author:** ![maximelb](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/maximelb/32/13_2.png) [@maximelb](https://community.limacharlie.com/u/maximelb)\
**Post date:** [November 14, 2025, 11:24pm UTC](https://community.limacharlie.com/t/field-correlation-of-events/532/2 "2025-11-14T23:24:47Z")

</div>

I don’t think that’s supported at the moment. ☹

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex033/uploads/limacharlie/original/1X/b2e9829e8e4281f2e5d87b4c4d424583144efe20.svg) [@system](https://community.limacharlie.com/u/system)\
**Post date:** [November 21, 2025, 11:25pm UTC](https://community.limacharlie.com/t/field-correlation-of-events/532/3 "2025-11-21T23:25:18Z")

</div>

Closed on November 21, 2025, 11:25pm UTC

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.