【解决思路】关于暴力破解 的Splunk 触发SPL

1：背景
参考文档: Brute Force, Technique T1110 - Enterprise | MITRE ATT&CK®

| tstats count values(Authentication.reason) as reason values(Authentication.signature) as signature max(_time) as latestTime min(_time) as firstTime from datamodel=Authentication.Authentication where Authentication.action="failure" sourcetyp=XXXX:login" by Authentication.action Authentication.src Authentication.user

| rename Authentication.* as *