Forum Discussion

Copper Contributor

Nov 18, 2024

DCR xPath - Nomenclature modification?

Hello, I have a question regarding the custom (xPath) configuration when creating a DCR for Windows Security Events via AMA Below is the xPath I was using until now to exclude the following EventID...

Copper Contributor

Nov 20, 2024

Put double quotes at the start and end of the path.

"Security!*[System[(EventID!=4689 and EventID!=5449 and EventID!=5145)]]"

A52

Copper Contributor

Nov 24, 2024

Does it work on your side? When trying it with double quotes like you mentioned, no single logs are coming in, as if it was breaking the logic of the xPath.