Organize the rule tests in order to create the least expensive rule test. The rules filter logicaly on events which are detected by the LOCAL system.

and when the event context is Remote to Local

and when the destination port is one of the following $1433$

and when an event matches any of the following Database: Concurrent Logins from Multiple Locations