After a suspected brute-force attempt, a security analyst must produce a summary report of all failed authentication events recorded by the Linux audit daemon on a RHEL 9 server. The analyst wants a high-level tally rather than raw event records. Which command produces this summary?