Reading Logs to Spot Attacks
Logs record what happened: who signed in, from where, and whether it worked. Defenders read them to notice attacks early. A classic sign of password guessing is many failed logins from one address in a short time.
The recipe is the same as any data task: parse each line, count by address, and flag anything above a threshold. Real systems then respond automatically, for example by blocking the address for a while or requiring a second factor.
Examplepython
Quick check
Which pattern in a log suggests password guessing?
Your turn: write the code
Count the FAIL lines per user name (third word) and print the user with the most failures.
Finish the quick check (and any code exercise) to complete this lesson, or mark it done yourself.
Tip: use the left and right arrow keys to move between lessons.