Close alert after 1 min?

[killmasta93]

Hi i was wondering if someone could shed some light on what im trynig to do. Currently i have SSH alert

{SSH Auth:log[/var/log/auth.log,"^.*sshd.*(Accepted|closed).*"].str(Accepted,#1)}=1

but i was reading a few forums to add this

.nodata(10)}=0

but could not get it working any ideas?
thank you