I need to turn the following filter into a correlation rule:

(xdastaxname:"XDAS_AE_CREATE_ACCOUNT" AND evt:"Create Object" AND
pn:"Novell eDirectory" AND msg:"Class\: User") NOT (sun:"SE10EDIR01-NDS"
OR sun:"Admin" OR sun:"us01citedirp001" OR sun:"us02citedirp001")

Basically, I want to send an email when an eDirectory account is created
outside of the provisioning process. Any help or suggestions would be
greatly appreciated.

Thank you