bcooper -
You are on the right path. The logic is a bit of a bear. So, you are looking for things that should NOT be there with the "not'ed" statement. So, this logic should be Alert if string IS FOUND.
No need for the Advanced config search block, just do the routine one (uncheck the Advanced Config Search Block) put that string in the box, and be sure to mark you are using regex.