If you use sysmon, modify the script and make AbuseIPDB call when conditions apply (RDP conns):

(metadata = win.eventdata.sourceIp, and triggered by = Public IP address)

If you don’t use sysmon, find windows security events related to AUTHs (non local) and apply same logic to the metadata that includes the remote IP.