Parses logs to find IPs with repeated failed authentication attempts. Alerts on thresholds within a time window to spot brute-force activity. Ideal for SIEM ingestion, automated alerts, or temporary blocking rules. Careful with NATed IPs — tune thresholds to avoid false positives.
logs = [
"192.168.1.10 failed login",
"192.168.1.10 failed login",
"192.168.1.20 failed login",
"192.168.1.10 failed login",
]
from collections import Counter
failed_ips = [line.split()[0] for line in logs if "failed login" in line]
counter = Counter(failed_ips)
for ip, count in counter.items():
if count > 2:
print(f"⚠️ {ip} has {count} failed login attempts!")
Recent Comments