Could someone tell me why this rule is creating alerts while the second
one is not working?@RSAAlert(oneInSeconds=0)SELECT * FROM pattern [
a=Event(reference_id.toLowerCase() IN ( '4663' )) -> every
b=Event(reference_id.toLowerCase() IN ( '4660' ) AN...
