Sequence Independent Correlation with EQL

Is it possible to create a custom rule that is the AND of three events that is order independent? For example, I would like to trigger when event A, event B and event C are satisfied, but I don't care what order they were received.
This is similar to this post (Question about EQL capabilities) that I don't think ever received an answer.


  • Joe

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.