ventData.IpAddress’) ip_address from events 고
Remote Desktop Protocol: Executing the 4624_4625 Login Query
https://news.sophos.com/en-us/2024/03/20/remote-desktop-protocol-executing-the-4624_4625-login-query/