Watcher alert to notify on failed SSH logins

ssh-watcher.json

{
  "trigger": {
    "schedule": {
      "interval": "300s"
    }
  },
  "input": {
    "search": {
      "request": {
        "search_type": "query_then_fetch",
        "indices": [
          "filebeat-*"
        ],
        "types": [],
        "body": {
          "query": {
            "bool": {
              "must": [
                {
                  "terms": {
                    "system.auth.ssh.event": [
                      "Failed",
                      "Invalid"
                    ],
                    "boost": 1
                  }
                },
                {
                  "range": {
                    "@timestamp": {
                      "gte": "now-5m"
                    }
                  }
                }
              ]
            }
          }
        }
      }
    }
  },
  "condition": {
    "compare": {
      "ctx.payload.hits.total": {
        "gt": 1
      }
    }
  },
  "actions": {
    "notify-slack": {
      "throttle_period_in_millis": 300000,
      "slack": {
        "message": {
          "to": [
            "#devops"
          ],
          "text": "Encountered {{ctx.payload.hits.total}} failed SSH logins in the last 5 minutes (facepalm)"
        }
      }
    }
  }
}