Authentication: multiple failures followed by success (SSH)

Assign this alert to yourself to see the evidence and start investigating.