Exclude specific 4768 events

Exclude specific 4768 events

I have "Unusual Activity" Alerts when mobile users use active sync on their mobile devices -exchange server.

Alert Profile Name:

Unusual Activity -Logon Time (Based on User) : View Alerts

Alert Message:

Logon activity was done by Itayl within 12-1 AM which deviates from user's normal Logon activity hours:2 AM-12 AM. Anomaly category:Unusual Activity -Logon Time (Based on User)



The event number is 4768, I attached the event log details.
I what to exclude logs 4768 that came from the exchange server (
Can I do it? I try to exclude by client address with the IP but it didn't work.