I am referring to https://community.rsa.com/docs/DOC-54594 to work to detect Windows Lateral Movement Detection. There is a rule regarding Correlation Rule: Windows Automated Explicit Logon. It states the threshold count should be greater than 9. Is it compulsory? Doesn't even one automated logon entry raise a concern?
I think you are right, you'd want to log some of these all the time. 7045 seems to jump out to me. In comparison, this is the splunk rule:
index=windows LogName=System EventCode=7045 NOT (Service_Name=tenable_mw_scan) | eval Message=split(Message,".") | eval Short_Message=mvindex(Message,0) | table _Ome host Service_Name, Service_Type, Service_Start_Type, Service_Account, Short_Message