_index=security_logs _sourceCategory=fw_security "action=deny" | parse "policyid=* " as policyid | parse "msg=\"*\"" as msg | count as msgcount msg | order by msgcount | limit 5