datafeed_suspicious_login_activity_ecs.json

{
  "job_id": "JOB_ID",
  "indices": [
    "INDEX_PATTERN_NAME"
  ],
  "max_empty_searches": 10,
  "query": {
    "bool": {
      "filter": [
        {"term": { "event.category": "authentication" }},
        {"term": { "agent.type": "auditbeat" }}
      ]
    }
  }
}