index="REPLACE_WITH_ESXI_SYSLOG_INDEX" host="REPLACE_WITH_ESXI_HOSTNAME_PATTERN" earliest=-14d
| regex _raw="(?i)(execInstalledOnly|esxcli\s+vm\s+process\s+(list|kill)|vim-cmd\s+vmsvc/(getallvms|power\.off|power\.shutdown|snapshot\.removeall|snapshot\.remove)|vim-cmd\s+hostsvc/(enable_ssh|start_ssh|enable_esx_shell|start_esx_shell)|esxcli\s+system\s+(syslog\s+config\s+set|account\s+(add|set)|permission\s+set|welcomemsg\s+set)|esxcli\s+network\s+firewall\s+set|chmod\s+\+?[0-7x]+\s+/(tmp|vmfs/volumes)/|SSH access has been enabled|ESXi Shell access has been enabled)"
| rex field=_raw "(?i)(?<action>execInstalledOnly|esxcli\s+\S+\s+\S+\s+\S+|vim-cmd\s+\S+|chmod\s+\S+\s+\S+|SSH access has been enabled|ESXi Shell access has been enabled)"
| bin _time span=10m
| stats count AS events values(action) AS actions BY _time host
| eventstats dc(host) AS hosts_in_window BY _time
| sort 0 - hosts_in_window _time