Does anyone know if SNARE can exclude logs to ship off to MARS? I have been trying but I cant find if its possible to do something like !7035 to exclude a specific event ID. They use a * to include all events, but I want an exclusion. Otherwise I would guess the only other way would be to exclude it from the event log all together, which I wouldnt want to do. Or even setup a drop rule in MARS to not log that event to the database, but then MARS is still doing the work and receiving the events.