Sounds like you are looking for aggregation. 'Trigger this response if multiple event occur within: 30 minutes' and 'When the number of events is at least: 5'
Grouping: Group aggregated events by 'Machine name'
Throttling would control how often the email notification would be sent. Device plug events can be generated fairly frequently depending on driver behavior so you may want to be careful setting that to something low.