How to write custom trigger condition?

[praju]

Hi Team,

Could you please help me on this request. I have a correlation search working fine and need to exclude these 3 filenames (setup64.exe & eggplantaiagent.exe & eggplantaiagentcmd.exe) using the custom trigger condition. Tried with several combinations and it not reflecting in the notables triggered. PFB main query and custom trigger condition for your reference and guide me how to feed the query by suppressing it in the custom trigger condition,

Main query:

index=sec_cb category=WARNING
| search type=CB_ANALYTICS
| search ((threat_cause_threat_category IN("KNOWN_MALWARE", "NEW_MALWARE") OR threat_cause_reputation IN("KNOWN_MALWARE", "PUP", "SUSPECT_MALWARE")) OR reason_code IN(”T_CANARY”))
| search NOT(reason_code IN(T_POL_TERM*) AND NOT(threat_cause_threat_category IN("KNOWN_MALWARE") OR threat_cause_reputation IN("KNOWN_MALWARE")))
| search NOT(reason_code="T_RUN_SYS" AND threat_cause_threat_category="NEW_MALWARE")
| search reason_code IN(T_*, R_*)
| search NOT
[| inputlookup scanner_ip.csv
| rename ScannerIP as threat_cause_actor_sha256
]
| search NOT(device_name("AZWPRDWVDIMT*" OR "AZWDRWVDIMT*") AND threat_cause_actor_name="automation controller.xlsm")
| stats count values(severity) as severity values(process_name) as process_name values(reason_code) as reason_code values(device_os_version) as os_version values(device_external_ip) as external_ip values(device_internal_ip) as internal_ip values(device_location) as location values(device_username) as username values(threat_cause_threat_category) as threat_category values(threat_cause_reputation) as threat_reputation values(category) as category values(reason) as reason dc(id) as id_dc values(threat_cause_actor_name) as threat_actor
values(create_time) as time by device_name id sourcetype
| rename device_name as hostname
| table hostname threat_actor id severity process_name reason_code reason os_version external_ip internal_ip location username threat_category threat_reputation category sourcetype time id_dc count

Custom trigger condition:

search threat_actor != "setup64.exe"

[richgalloway]

In my experience, it's better to put the trigger conditions in the search itself and have the alert/CS trigger when the number of results is not zero.