Thanks a lot. This rule works perfectly.

Code:
--------------------

filter(((e.XDASClass = 2) AND ((e.XDASIdentifier = 4) OR (e.XDASIdentifier = 0)) AND ((e.XDASOutcome = 0) OR (e.XDASOutcome = 1) OR (e.XDASOutcome = 2))))flow trigger(5,900,discriminator(e.InitiatorUserName,di stinct e.SourceIP))

--------------------


--
sharfuddin
------------------------------------------------------------------------
sharfuddin's Profile: https://forums.netiq.com/member.php?userid=1016
View this thread: https://forums.netiq.com/showthread.php?t=57541