without clause
In a query, a without clause specifies event types, which must be specified in the query's inputs block, whose presence prevents a match. For example, if a potential match set contains three events, it can be a match only if a type specified in a without clause was not added to a window after the first event or before the third event. Any event type that can be used in the find pattern can be used in the without clause.