Found it:
{job="defiant", appname="snort"} | pattern `[<gid>:<sid>:<rev>] "<class> <message>" [Classification: <classification>] [Priority: <priority>] {<proto>} <src>:<spt> -> <dst>:<dpt>` | (classification =~ `.*(Attempt|Attack).*` OR message =~ `.*(login attempt|[Aa]ttack).*`)