VMware ESXi - Multiple Failed Shell Login via SSH

Original query, unchanged.

// To Adapt to your environment
let triggerThreshold = 10;
VMwareESXi
| where SyslogMessage has "sshd"
| where SyslogMessage contains "authentication failure"
| extend SrcUsername = extract(@'\[info\]\s+\[(.*?)\]', 1, SyslogMessage)
| extend DstHostname = extract(@'\[\d+\]\s+\[(.*?)\s+on', 1, SyslogMessage)
| extend SrcIpAddr = extract(@'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})', 1, SyslogMessage)
| summarize make_set(SrcUsername),count() by SrcIpAddr,DstHostname
| where count_ >= triggerThreshold
| extend HostCustomEntity = DstHostname