Forum Discussion
Monitor Data Collection Rules to EXCLUDE eventids
we are struggling to exclude specific EventID's using a DCR against 3 azure based VMs != doesn't seem to work. any guidance appreciated.
Instead of !=, try using not(EventID=XXXX):
Security!*[System[not(EventID=4624)]]