How do I exclude multiple specific fields from search results?

[bcdatacomm]

I have a saved search that I alert on and there is certain events I don't want the alert to trigger for when it's coming from inside my network.

Basically I have a this saved search:
index=pan_logs (log_subtype=vulnerability OR log_subtype=wildfire) | fields action, severity, CATEGORY, SUBCATEGORY, direction, dst_hostname, dst_ip, dst_user, dst_zone, log_subtype, misc, rule_name, sourcetype, src_ip, src_zone, threat_name, url, protocol, server_location

It sends me all the alerts we want to see, but there is a couple alerts I don't care about. Especially ones that come from "src_zone=inside + dst_zone=outside + threat_name=IIS DDOS"

So, how do I get my search to display everything except the events that are from inside to outside and the threat name is IIS DDOS?

[richgalloway · Accepted solution]

Have you tried this?

index=pan_logs (log_subtype=vulnerability OR log_subtype=wildfire) NOT (src_zone=inside AND dst_zone=outside AND threat_name=IIS DDOS) | fields action, severity, CATEGORY, SUBCATEGORY, direction, dst_hostname, dst_ip, dst_user, dst_zone, log_subtype, misc, rule_name, sourcetype, src_ip, src_zone, threat_name, url, protocol, server_location

[bcdatacomm]

That worked! Thanks!