Ignore user identification by machine

[DJ71]

I've gone through the docs for FSSO and either I'm missing it or it just doesn't work the way I want it.

We have an app that does LDAP authentication and when a user authenticates FSSO "thinks" the user is logged into that system which cascades down into the reports.  This also happens when users interact with other servers that aren't using LDAP.  I know you can configure the collector to ignore certain users but I'm hoping to set it to ignore authentication events that are sourced from a set of machines.

Using DC polling method and 5.6.1 on the Fortigate.  Maybe I'm examining the wrong event log ID's on the collector?  DC's are 2016.

Dan