I want to create a rule which allows me to NOT see the normal ping in results. I need to modify this rule below but I can\'t find any info on how to negate classtype:icmp-ev
