eventType:policy.rule.update OR eventType:policy.rule.delete