How about a rule that uses the Python find primitive, so:

evt.component.find('Microsoft') != -1

If it doesn't find the string anywhere within the component field then it will return -1 so you have a != test.

Create a new event - actually probably a subclass of an existing event.
Then you need to create a mapping - you may find it easiest to find an existing, applicable event and use the little tree icon at the top of the event console to map an existing event to your new event class.
Then modify the mapping for that event (which will have been created automatically for you), and put the above expression in the Rule box.

If you don't already have it, you may find my paper on Zenoss Event Management helpful - http://www.skills-1st.co.uk/papers/jane/zenoss4-events/

Cheers,
Jane

Email: jane.curry@skills-1st.co.uk    Web: https://www.skills-1st.co.uk

Another example:

if "HP ETHERNET" in getattr(evt, 'component', ''):
evt._action = "drop"

Hydruid