A few of our clients get between 50-100 event 529s per day in Security Event Log. Lately with two of our clients, we are seeing them in the THOUSANDS, from foreign IP addresses. I usually document the IP as best I can via ip-lookup.net and try to get a region identifier. Many times the IP ranges aren't registered with ARIN. Also, we see these coming from various regions on a day-to-day basis: Sometimes from Germany, Spain, Russia, US, Australia, etc.
Is there a standard best-practice in auditing these events and is there a solution such as changing RDP ports or some such we should look into? Does everyone see these events often, or is this possibly something we've overlooked? Thanks!