[rules-users] Event pattern matching