[Juniper SRX] Add event.category and event.outcome to failed SSH login attempt

[Oddly]

We have added Juniper switches to this integration, but we see no SIEM alerts on failed SSH attempts to this switch.
Looking at this integration, it seems like this can be added easily by doing the following steps.

Original event:

<37>1 2024-11-22T12:45:00.207+01:00 ams-edge-sw-003 sshd - SSHD_LOGIN_FAILED [[email protected] username="user1" source-address="192.168.0.3"]

This are the relevant fields as parsed by the integration:

juniper.srx.tag: SSHD_LOGIN_FAILED
source.user.name: user1

It seems to me that by filtering for "SSHD_LOGIN_FAILED" and then setting event.category (authentication) and event.outcome (failed ?) this can be easily added to existing SIEM alerts.

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)