Exclude specific 4768 events

Exclude specific 4768 events

Hi
I have "Unusual Activity" Alerts when mobile users use active sync on their mobile devices -exchange server.

Alert Profile Name:

Unusual Activity -Logon Time (Based on User) : View Alerts

Alert Message:

Logon activity was done by Itayl within 12-1 AM which deviates from user's normal Logon activity hours:2 AM-12 AM. Anomaly category:Unusual Activity -Logon Time (Based on User)

Severity:

Trouble


The event number is 4768, I attached the event log details.
I what to exclude logs 4768 that came from the exchange server (10.0.0.20).
Can I do it? I try to exclude by client address with the IP but it didn't work.