The flag for this exercise is impossible to get. There is no Rule ID (92653) in the security alert section and no Type 10 logins in the last 24 hours.
I just ran through the lab, and it works as written. If you are not seeing any login alerts, be sure you have tethered Windows to Wazuh correctly. Note the lab flag is merely checking that the local_rules.xml file is edited correctly:
