Remote Logon
Query
//Accounts that logged on remotely to specified computer, and how many times
search in (SecurityEvent) EventID == 4624 and (LogonTypeName == "3 - Network" or LogonTypeName == "10 - RemoteInteractive") and Computer == "<yourcomputername>"
| summarize RemoteLogonCount = count() by AccountExplanation
This query searches for accounts that have logged on remotely to a specific computer and counts how many times they have done so.