datafeed_suspicious_login_activity.json

{
  "job_id": "JOB_ID",
  "indices": ["INDEX_PATTERN_NAME"],
  "max_empty_searches": 10,
  "query": {
    "bool": {
      "filter": [{ "term": { "event.category": "authentication" } }]
    }
  }
}