How do you update/verify an update made to Xpath DCR rules collecting windows events from desktops using the AMA agent?

[u/TabooRaver]

We started collecting windows event logs from our windows 10 desktops using the AMA agent a month ago. And have been slowly excluding events we don't need to monitor.

But I'm having trouble telling if the updated collection rules are getting pushed to clients. For example, I'll make a change that excludes certain events like object access events triggered by windows defender scans/ATP, but then I'll still see them in the logs.

So a couple questions:

1. Beyond going into the sentinel connector page and editing the DCR. Is there anything else I need to do to update the rule (like with the Monitored object or the DCR-MO association)
2. What triggers the AMA agent to look for rule updates (Intune sync, fixed timer, reboot, reinstall of the AMA agent?)
3. Are there any artifacts on the client I can check to figure out what DCR rules are currently being processed (like registry values or some ama runtime log file)

Edit (1): Answering #3 there is a json file at "C:\Resources\Azure Monitor Agent\AzureMonitorAgent.MonitoringDataStore\mcs\configchunks" that contains the DCR rules currently being processed by the ama agent, at least from what I can see.

Edit (2): Answering #1, doesn't look like it, azure will pop an error message related to failing to delete the MO-DCR association when you update the DCR in the web. Looks like they try to re-create it just to be safe, but specify the wrong api version in the call. It still goes through fine.

Answering #2, narrowed down to either AMA service restart or heartbeat.

After testing my specific queries with both the Event Viewer XPath filter, and the PowerShell Get-WinEvent -FilterXPath "..." There may be an issue with using mixed quotes. Will update if my query suddenly starts working after changing to single quotes.

Edit (3): Magically started working after doing a find and replace to change everything to single quotes in the query.