EQL query to alert 1 alert per each user

Thank you! You helped me a lot! It works exactly how I wanted.

1 Like