OK, this is starting to make sense.
Here's an example ...
XML output for a line-crossing event on my 5442.
Code:
<s:Body>
<tev:PullMessagesResponse>
<tev:CurrentTime>2023-04-21T16:49:21Z</tev:CurrentTime>
<tev:TerminationTime>2023-04-21T16:50:31Z</tev:TerminationTime>
<wsnt:NotificationMessage>
<wsnt:Topic Dialect="http://www.onvif.org/ver10/tev/topicExpression/ConcreteSet">tns1:RuleEngine/LineDetector/Crossed</wsnt:Topic>
<wsnt:Message>
<tt:Message PropertyOperation="Changed" UtcTime="2023-04-21T16:49:20Z">
<tt:Source>
<tt:SimpleItem Value="00000" Name="VideoSourceConfigurationToken"/>
<tt:SimpleItem Value="00000" Name="VideoAnalyticsConfigurationToken"/>
<tt:SimpleItem Value="IVS-5" Name="Rule"/>
</tt:Source>
<tt:Key>
<tt:SimpleItem Value="310311" Name="ObjectId"/>
</tt:Key>
<tt:Data>
<tt:SimpleItem Value="false" Name="State"/>
</tt:Data>
</tt:Message>
</wsnt:Message>
</wsnt:NotificationMessage>
</tev:PullMessagesResponse>
</s:Body>
Note in the 'RuleEngine/LineDetector/Crossed' NotificationMessage that the 'Source' entry 'Rule' has the value 'IVS-5'.
This aligns with my IVS setup in the camera. I triggered the camera for this event by crossing line IVS-5.
View attachment 160642