I hope you're saying you want to INCLUDE events where final "Action Taken" is "Partly Remove" OR "Unkonwn", so try this one.
your base search | transaction maxspan=60m startswith="ActionTaken=None" keeporphans=t | where isnull(mvfind(ActionTaken,"removed")) OR isnull(mvfind(ActionTaken,"blocked"))
Basically add all the ActionTaken your want to exclude in the where clause
Error in 'where' command: The arguments to the 'isnull' function are invalid.
can you please check if there is something wrong in the syntax
@somesoni2 updated the query. can you confirm whether or not this worked for you?