This rule detects potential SSH brute force activity targeting macOS hosts by analyzing sshd authentication failures reported to the macOS Security Events integration. It watches for common failure messages (Failed password for, Failed keyboard-interactive/pam for, PAM: authentication error for) and for cases where a probe ends with Connection closed by invalid user, counting these events per host within a short window. Successful authentications are not counted. When the per-host event count reaches the defined threshold (20 in the rule window), the rule raises an alert and surfaces the targeted usernames and source IP addresses. The alert includes Esql.user_name_values and Esql.source_ip_values, with distinct counts Esql.user_name_count and Esql.source_ip_count, enabling differentiation between password guessing (single username from many sources) and password spraying (many usernames from a single source). The rule maps to MITRE ATT&CK techniques T1110 (Brute Force) with subtechniques T1110.001 (Password Guessing) and T1110.003 (Password Spraying), under the credential access tactic TA0006, and also notes External Remote Services (T1133) under Initial Access TA0001. The detection leverages the macOS Security Events data source to identify authentication anomalies on macOS endpoints and is intended for threat detection and incident response workflows. If a successful login follows failures, this may indicate compromise and should trigger additional investigation and containment steps.