The correlation rule is correct. Don't split components in AND or OR gates because they are used for correlating multiple events. In your case you just need to correlate on the information inside Sig ID 43-***.
In my case I would group by Source User because Destination User is empty.
Here is a document which can help you in the future: https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/ 25000/PD25633/en_US/McAfee%20SIEM%20Best…