Create a UDG with the DetectionIP of the one machine. Create a UDG with only the whitelisted device. Add a new AND Group to your Correlations box that contains [DetectionIP does not contain the UDG with that machine] AND the [ExtraneousInfo does not contain the UDG that has the USB of that whitelisted device].
↧