Because of some bug, devices keep getting put into the quarantine policy because of Underminr activity.
In order to change these devices back to the policy they belong, we either need these events to be logged under Events, or include the old policy in the email alert.