Forum Discussion

mikebaker26's avatar
mikebaker26
Brass Contributor
Apr 16, 2024

Monitor Data Collection Rules to EXCLUDE eventids

we are struggling to exclude specific EventID's using a DCR against 3 azure based VMs

!= doesn't seem to work.

any guidance appreciated.

Data Collection Rules
Log Analytics

1 Reply

  • Kidd_Ip's avatar
    Kidd_Ip
    MVP
    Jun 16, 2025

    Instead of !=, try using not(EventID=XXXX):

     

    Security!*[System[not(EventID=4624)]]

     

Resources