erni1989,
To do that kind of alerting you need to have an Event Stream Analysis (ESA) server. The ESA has the ability to keep track of multiple events and patterns to produce alerts. The creation of ESA rules can be a very complex process. Below are some of our documentation that you can use for reference.
ESA Rules: https://community.netwitness.com/t5/netwitness-platform-threat/rsa-esa-rules/ta-p/677885
Creating ESA Rules: https://community.netwitness.com/t5/netwitness-platform-online/create-an-esa-rule/ta-p/688878
Configure ESA Correlation Rules:https://community.netwitness.com/t5/netwitness-platform-online/configure-esa-correlation-rules/ta-p/669425
If you are looking for more assistance with actually creating ESA rules, I highly suggest engaging our Professional Services. They are a paid engagement and you would need to talk with your NetWitness Sales/Account Representative. If you have some questions about syntax, you can open a NetWitness Support case and we can try to clarify any syntax usage questions.
