Login Unknown User Formant Alert Rule

Hello

Our company very recently configured a Logpoint for ourself and a Customer.
the Customer asked for a alert rule, to Alert us and them, whenever someone Attempts to login with a Unknown username format. To see those attempts and see if someone accidentally typed their Password in the username Field.

for this I created this rule (there is probably better ways to do this)

-("source_address"="ip") -("source_address"="iü") -("user"="du*")  -("user"="MINWINPC") -("user"="ch*")  -("user"="firewall") -("user"="aa*")  -("user"="da*") -("user"="nu*") -("user"="su*") -("user"="la*")   -("user"="cba_anonymous") -("user"="ex*") "reason"="Unknown user name or bad password."  "event_category"="Logon" device_ip=ip or device_ip=ip

The Rule ended up being pretty long, but it mostly works.
The mostly being that it generates a lot of noise, because there is a lot of Alerts with user Null, so empty, these alerts seem to come from the DC itself.
And I am trying to Exclude null from the search.
I tried.

-(“user”=”null”), -(“user”=”NULL”), -(“user”=”*”) and -(“user”=*)
but none of them actually excluded null.

Does anyone Know or have an idea on how to Exclude null results in a search, that would be a great help.
Also open for more efficient ways for the rule since it is really loong haha.

Thanks in advance Cheers Mike