What is the best approach to create a complex filter with many OR statements?


We want to make a ruleset where we only query for users that we’ve seen
within our network. This however is about 10M+ users. Is there a way to
filter data by this many users? What’s best approach?


You can create a CSDL definition that uses the target interaction.author.id and supplying with the ID of the user. A mapping of interaction.author.id to data sources can be found here.

Supplying a list of 10M+ users in one CSDL definition would likely exceed the 1MB size limitation. So, you would need to separate your list of users into sub-streams and then reference them using the "stream" keyword (effectively creating a master stream).