SSH Brute Force detection [splunk-unix]

`get_endpoint_data` `get_endpoint_data_unix` TERM(ssh) TERM(res=failed) TERM(type=USER_AUTH)
| rex field=_raw "[^\w]"(?<process_name>"(ssh)")"[^\w]"
| eval src_ip=mvfilter( NOT match(addr,"\?")), user=mvappend("",acct,user,auid,uid), user=mvfilter(NOT match(user,"\?
| \(unknown\)
| \d+
| unset
| ^\s$
| ^$")), user_id=mvappend("",auid,uid), user_id=mvfilter(match(user_id,"\d+"))
| table _time, host, user process, process_*, res, src_ip, user_id
| bin _time span=10sec
| eventstats count by host, _time, res
| stats values(*) as * by host, _time, res
| where count > 3
| bin _time span=10min
| stats values(*) as * list(count) as count_list sum(count) as count_span by host, _time, res
| where mvcount(count_list) > 1 
OR count_span > 20
| rename count_span as count
| lookup dnslookup clientip as src_ip OUTPUT clienthost as src_dns
| iplocation prefix="src_" src_ip
| rename src_Country as src_country