authentication where host.os.type == "windows" and event.code in ("4624", "4625") and endswith~(user.name, "$") and
    winlog.event_data.AuthenticationPackageName : "NTLM" and winlog.logon.type : "network" and

    /* Filter for a machine account that matches the hostname */
    startswith~(host.name, substring(user.name, 0, -1)) and

    /* Verify if the Source IP belongs to the host */
    not endswith(string(source.ip), string(host.ip)) and
    source.ip != null and source.ip != "::1" and source.ip != "127.0.0.1"