Every SIEM solution produces noise when newly deployed. You need to finetune the rules that you have written to reduce false positives.
@Michel de Crevoisier has shared you list of rule names to detect malicious activity. you may start working on fine tunening these rules
Your SIEM rule must consider the logs with event id 4625, and for example a ...
Dealing with Windows failed events can be a very hard task. Firstly, you have consider 2 types of failed events in Windows:
Kerberos logins (not in your scope): ID 4768, 4769, 4771
Windows logins: ID 4625, ID 4776
Considering now your event, the most meaning full events are the following:
Logon Type: 3 > network event
Workstation Name: Win10-Wrk > ...