"auditType.category":Authentication "auditType.action":User\ login\ failed\(SSH\)