[rules-users] Matching consecutive events