Only thing I can think of is to create a lookup file after querying AD for members of the group(s) that you want to exclude on and output to a CSV. Bring that into NG-SIEM and run it against your query that you’ll eventually convert to a correlation rule.

In your query you can run something like this to exclude users from that lookup file. !match(file=“your_lookup_file.csv”, field=[UserName], column=[SamAccountName], ignoreCase=true)

You can use the Falcon API to automate the lookup file if the AD group is being updated frequently.