Consider a two-rule approach; the first rule generates some temporary or pivoting meta, and you can use that temporary meta as part of a second query to do what you're actually interested in doing.
Rule 1 matches the domains you want to filter out:
filter_domains = alias.host contains microsoft.com, intranet.local, filter.org
session options:
- Alert into "alert" key (or other key as desired)
- Transient
Rule 2 does whatever you're actually interested in, excluding your filtered domains
the_real_deal = alert != filter_domains && [ your other filter(s) of interest here ]
My understanding is that the "transient" option on Rule 1 will cause that meta to be available for other app rules but not be stored in the metadb, so you're not clogging up your DB with alert = filter_domains records that you may not really care about.
(Under certain circumstances, Rule 1 may be better served by being set up as a feed instead of an app rule, but it will be left to the reader to determine those conditions - or to start another thread to determine them.)
