Hi dear community...
I'm interested in building a correlation rule to trigger when in a specific event,
and destination source user field is empty.
but i have a hard time understanding How to represent "empty" \ "nothing" in the system.
i will really appreciate your help/ thank you very much !!!
I think the right Syntax is:
Try it 🙂
Download the new ePolicy Orchestrator (ePO) Support Center Extension which simplifies ePO management and provides support resources directly in the console. Learn more about ePO Support Center