Offense Name: Interactive Login with Service Account Rule: Service accounts typically start with svc*
Offense Name: Interactive Login with Local Administrator Rule: Local admin user is rs0
I want correlation search please
