That sounds alot like this example:A create user, login as that user,
and delete user in a 300 second window...EPL
#3:https://sadocs.emc.com/0_en-us/090_10.4_User_Guide/50_Alert/40_DefineESARules/20_DefineAdvESARule/SampleAdvESARuleSELECT
* FROM Even...
I use this to link two events together/ Both events must occur within 10
seconds. The SELECT statement limits the events to look at, and provides
the time window... The 'MATCH RECOGNIZE' defines the match between the
events. You check both ways (the ...
