Need some help with my first rule

I have read the previous thread regarding this.
There appear that there is no direct solution to you problem.

Reading the log file and catching the lines seems to be a way to go

See: