Log Analytics WindowsFirewall - table transformation not working

Hello,

I am collecting Windows Firewall logs via AMA from servers - that is working fine, I have ingested logs. But what I am trying to set up is transformation with DCR to collect only DROP records. Transformation KQL source | where FirewallAction != "ALLOW" or source | where FirewallAction == "DROP" (tried both). But still getting all records (ALLOW, DROP) to WindowsFirewall table. I have also tried different queries, filter, but still the same - looks like that transformation is not working.

Any hints where I should take a look, what could be configured wrong ?

Thanks a lot.

BR, AK