datafeed_v3_windows_rare_user_type10_remote_login.json

{
    "job_id": "JOB_ID",
    "indices": [
      "INDEX_PATTERN_NAME"
    ],
    "max_empty_searches": 10,
    "query": {
       "bool": {
      "filter": [
        {
          "term": {
            "winlog.event_data.LogonType": "10"
          }
        }
      ],
      "must": [
        {
          "bool": {
            "should": [
              {
                "match": {
                  "event.type": {
                    "query": "authentication_success",
                    "operator": "OR"
                  }
                }
              },
              {
                "match": {
                  "event.action": {
                    "query": "logged-in",
                    "operator": "OR"
                  }
                }
              }
            ]
          }
        }
      ]
    }
    }
  }