Hello Hello, Trying to make this search work: | tstats allow_old_summaries=true dc(Malware_Attacks.signature) as "infection_count" from datamodel=Malware where ((Malware_Attacks.file_path!="C:\ProgramData\Adobe*") nodename=Malware_Attacks) by "Malware_Attacks.dest", "Malware_Attacks.file_path" | rename "Malware_Attacks.dest" as "dest" | where 'infection_count'>1 (The goal being to exclude any event which has a file path containing "C:\ProgramData\Adobe\*"). I'm open to the NOT operator instead of !=.  I've tried a handful of different ways of wording this query, but can't get it to produce what I want. Thank you to whoever can shed light on this!   ... View more