Improve log filtering workflow with quick “exclude / NOT filter” option from Traffic logs

[LeonardoMachado]

Hi team,

I’d like to suggest a small but impactful improvement to the Traffic Logs filtering workflow.

Today, when we click on a value in a log entry (e.g. source IP, destination IP, user, etc.), it automatically adds that value to the search bar as a positive filter (e.g. eq / in). This is extremely useful and significantly speeds up building queries.

However, during investigations, it is very common to also build exclusion filters (e.g. neq / not in) while drilling into traffic patterns. Right now, this requires manually editing the query after adding the value, which slows down the workflow.

Suggestion:
Introduce a quick way to add a value as a negated filter directly from the log view. For example:

• Standard click → adds positive filter (current behavior)
• Shift + click (or another modifier / UI option) → adds the same value as a negative filter (neq / not in)

Benefit:
This would significantly speed up investigative workflows by allowing analysts to quickly include or exclude values without manually editing the query syntax, reducing friction and improving usability during time-sensitive troubleshooting.

Thanks for considering this improvement — it would be a great enhancement for daily SOC / network analysis workflows.