Our security events count is in millions and we observed that we have more then 600 service accounts in our environment and they contribute millions of events for a/c log on events and hence we want to drop these events for service accounts.
Is there a regex available to drop service account events from active directory to be used on the universal forwarder?
