I have a number of log source types that incorrectly produce secondary/tertiary log sources of different types. Is there a good way to prevent this other than mapping all of the events being attributed to the other log sources, disabling log source autodetection, or creating an override event category and ID regex for a value present in all logs from that log source type and mapping it manually to "Unknown Event"?

Following - having same issue.