Unless I'm missing something in your description, you would leave the correlation intact, but change the action.
If you want to only detect unauthorized attachment and not detach the device, remove the detach action and add the e-mail action.
If you want to modify the rule to detach, warn the user with a popup and send you an e-mail, you just add the Send Email action to the existing rule.