Organize the rule tests in order to create the least expensive rule test. The rules filter logicaly on events which are detected by the LOCAL system. a$.$ and when the event context is Remote to Local

b$.$ and when the destination port is one of the following $1433$

c$.$ and when an event matches any of the following Database: Concurrent Logins from Multiple Locations