Is it possible to create a custom rule that is the AND of three events that is order independent? For example, I would like to trigger when event A, event B and event C are satisfied, but I don't care what order they were received.
This is similar to this post (Question about EQL capabilities) that I don't think ever received an answer.
Thanks!
- Joe