Set "A Number of Distinct Values must be observed."and then enable the NOT. See if that helps.
Did you get this to work?
If you did, can you post details?
You should change your Correlation rule to a Sequence
1. Signature ID in 360-2413
2. Signature ID Not in 360-2412
360-2412 = Deployment failed
360-2413 = Attempt to unistall Mcafee Agent
For this you didn't need the "Not Match" rule