diff --git a/x-pack/plugins/security_solution/public/actions/filter/lens/create_action.ts b/x-pack/plugins/security_solution/public/actions/filter/lens/create_action.ts
index 61943e891918f..64db74fd2f486 100644
--- a/x-pack/plugins/security_solution/public/actions/filter/lens/create_action.ts
+++ b/x-pack/plugins/security_solution/public/actions/filter/lens/create_action.ts
@@ -108,7 +108,8 @@ export const createFilterLensAction = ({
         });
         return;
       }
-
+      
+      const addFilter = negate === true ? addFilterOut : addFilterIn;
       addFilter({
         filterManager,
         fieldName: field,