Detect Reduce Key Space in Splunk

index=network (
    sourcetype=syslog OR
    sourcetype="cisco:ios" OR
    sourcetype="cisco:iosxe" OR
    sourcetype="cisco:asa" OR
    sourcetype="cisco:asa:firewall" OR
    sourcetype="cisco:nexus" OR
    sourcetype="juniper" OR
    sourcetype="juniper:junos:idp" OR
    sourcetype="paloalto:firewall" OR
    sourcetype="fortinet:fortigate:traffic" OR
    sourcetype="checkpoint:firewall"
)
(
    ("crypto key generate" ("512" OR "768"))
    OR ("crypto key generate ec" AND ("192" OR "224"))
    OR ("crypto isakmp policy" AND ("group 1" OR "group 2" OR "encryption des" OR "encryption 3des" OR "hash md5"))
    OR ("crypto ipsec transform-set" AND ("esp-des" OR "esp-3des" OR "ah-md5-hmac" OR "esp-null"))
    OR "ip ssh version 1"
    OR ("ssl encryption" AND ("rc4" OR "des" OR "null"))
    OR ("CRYPTO_ENGINE_KEY_GENERATED" AND ("512" OR "768"))
    OR ("CRYPTO_ENGINE_KEY_DELETED" AND "rsa")
    OR ("modulus" AND ("512" OR "768"))
    OR ("DHGroup1" OR "DHGroup2" OR "DHGroup14")
    OR ("IKEv1" AND "DES")
)
| eval WeakRSAKey=if(match(_raw, "(?i)(modulus\s+512|modulus\s+768|key-length\s+512|key-length\s+768)"), 1, 0)
| eval WeakECKey=if(match(_raw, "(?i)(keysize\s+192|keysize\s+224|ec\s+192|ec\s+224)"), 1, 0)
| eval WeakDHGroup=if(match(_raw, "(?i)(group\s+1\b|group\s+2\b|DHGroup1|DHGroup2|\bDH1\b|\bDH2\b)"), 1, 0)
| eval WeakSymCipher=if(match(_raw, "(?i)(esp-des\b|\bencryption\s+des\b|\bencryption\s+3des\b|\besp-3des\b|\bnull-enc\b|\besp-null\b|\brc4\b)"), 1, 0)
| eval WeakHash=if(match(_raw, "(?i)(ah-md5-hmac|\bhash\s+md5\b|\bmd5\b.*hmac|\bauth\s+md5\b)"), 1, 0)
| eval WeakSSHVersion=if(match(_raw, "(?i)(ip\s+ssh\s+version\s+1)"), 1, 0)
| eval WeaknessScore=WeakRSAKey + WeakECKey + WeakDHGroup + WeakSymCipher + WeakHash + WeakSSHVersion
| where WeaknessScore > 0
| eval RiskLevel=case(
    WeaknessScore >= 3, "Critical",
    WeaknessScore == 2, "High",
    WeaknessScore == 1, "Medium",
    true(), "Low"
  )
| eval WeaknessTypes=mvappend(
    if(WeakRSAKey=1, "WeakRSAKey", null()),
    if(WeakECKey=1, "WeakECKey", null()),
    if(WeakDHGroup=1, "WeakDHGroup", null()),
    if(WeakSymCipher=1, "WeakSymmetricCipher", null()),
    if(WeakHash=1, "WeakHashFunction", null()),
    if(WeakSSHVersion=1, "SSHv1Enabled", null())
  )
| table _time, host, sourcetype, _raw, WeaknessTypes, WeaknessScore, RiskLevel,
        WeakRSAKey, WeakECKey, WeakDHGroup, WeakSymCipher, WeakHash, WeakSSHVersion
| sort - _time