Searching logs for something suspicious does not work, and it is worth understanding why before you spend a year doing it.
You cannot search for what you have not thought of. A query is a guess about what the attacker did, and the good ones are the guesses you would not have made. So the productive technique is almost the opposite of searching: instead of asking what is bad, ask what is rare, and then ask why.
Frequency analysis is the whole method, and it is embarrassingly simple. Take a field. Count how often each value appears. Read the bottom of the list.
Nearly every host in your estate talks to the same handful of destinations. The one workstation that resolved a domain nobody else has ever asked for is at the bottom of that count, and it took one command to find. The same trick works on user agents, on parent-child process pairs, on which accounts logged into which machines, on JA3 hashes, on outbound ports. Sort ascending. Read the tail.
The second technique is stacking two fields that are normally independent. Account and workstation, for example. Most people log into one or two machines. An account that appears on eleven, over a weekend, is not doing anything a filename-based rule would catch, and it is the clearest signature of credential reuse there is.
Third: baseline against time rather than against a threshold. "More than fifty failed logins" is a number someone guessed. "Ten times this account's own weekly average" adapts to a service account that legitimately fails often and to a human who never does.
Two practical warnings, both learned the hard way.
Absence is evidence. A host that logged steadily for months and went quiet on Tuesday is telling you something, and no search for bad things will surface it — you have to be looking for the gap. Alert on silence from sources that should be talking.
And write down what you ruled out. An investigation that ends "nothing found" is nearly worthless to the next person, who will repeat every query you already ran. An investigation that ends "checked A, B and C, here is why each was normal, did not have data for D" is a real handover, and D is where the next person starts.