eventType:application.policy.sign_on.update OR eventType:application.policy.sign_on.rule.delete