Hi dear community...
I'm interested in building a correlation rule to trigger when in a specific event,
and destination source user field is empty.
but i have a hard time understanding How to represent "empty" \ "nothing" in the system.
i will really appreciate your help/ thank you very much !!!