1 of 1 people found this helpful
A RSD automatic response should not be based off a query rather you should base it off an RSD Detection event.
You should already have a default RSD response called "RSD: Query New Rogue Detection". Simply edit this response and add your filter criteria to the "Filter" tab. You should not have to add a filter for the time because this response will trigger in the event of an RSD detection (so it should always be within a few minutes of the detection). If you wish to push the agents at a specific time (not tied to the RSD detection event) then set the RSD response action to "add to system tree" rather than "push agent". Then you can automate a query that pushes the agent to unmanaged machines or to machines in a specific group however you like.
Can't delete so ignore
After a wander through the documentation I tracked this down under Automation. That appears to have done the trick, thanks.