Runtime transformation in Sentinel

[securityxpert1122]

I want to exclude windows EventID 4663 and ObjectType =file using runtime transformation. I applied below:

| where EventID != 4663 and ObjectType != "File"

but it removes all 4663 events rather removing based on objecttype which I made combination with eventid. please help. Thanks 

[#2]

@securityxpert1122 

You want this 

| where not(EventID == 4663 and ObjectType == "File")

[#3 · Accepted solution]

yes, thats exactly I wanted. Thank you so much for your help.