datafeed_auth_rare_source_ip_for_a_user.json

{
  "job_id": "JOB_ID",
  "indices": [
    "INDEX_PATTERN_NAME"
  ],
  "max_empty_searches": 10,
  "query": {
    "bool": {
      "filter": [
        {
          "term": {
            "event.category": "authentication"
          }
        },
        {
          "term": {
            "event.outcome": "success"
          }
        }
      ]
    }
  }
}