[rules-users] Not conditional 'not' for event streams?