// Illustrative; not run against live data. Sumo Logic, firewall logs with key=value fields.
// Outbound Remote Desktop to public addresses, per source and destination per day. Adjust the field names to your firewall.
_sourceCategory="REPLACE_WITH_FIREWALL_SOURCE_CATEGORY" "3389"
| parse regex "(?:srcip|src|src_ip)=(?<src_ip>\d{1,3}(?:\.\d{1,3}){3})" nodrop
| parse regex "(?:dstip|dst|dst_ip)=(?<dst_ip>\d{1,3}(?:\.\d{1,3}){3})" nodrop
| parse regex "(?:dstport|dpt|dst_port)=(?<dst_port>\d+)" nodrop
| where dst_port = "3389" and !isNull(dst_ip) and !isPrivateIP(dst_ip)
| timeslice 1d
| count by _timeslice, src_ip, dst_ip
| sort by _timeslice desc