Step 6: Spot suspicious activity

Logs are also a security tool. Four 401 (Unauthorized) responses in a row from one address on the login page looks like someone guessing passwords. Count failures per IP and alert above a threshold. Then print that IP's other requests for context, the way a real investigator would.

Examplepython

import re
from collections import Counter, defaultdict

LOG = """2026-11-05 09:00:01 10.0.0.5 GET /home 200 120
2026-11-05 09:00:03 10.0.0.9 GET /login 200 80
2026-11-05 09:00:07 10.0.0.9 POST /login 401 95
2026-11-05 09:00:09 10.0.0.9 POST /login 401 91
2026-11-05 09:00:12 10.0.0.9 POST /login 401 99
2026-11-05 09:00:15 10.0.0.9 POST /login 401 97
2026-11-05 09:01:02 10.0.0.5 GET /courses 200 340
2026-11-05 09:01:20 10.0.0.7 GET /courses/python 200 410
2026-11-05 09:01:44 10.0.0.7 GET /missing 404 30
2026-11-05 09:02:05 10.0.0.5 GET /api/progress 500 1200
2026-11-05 09:02:09 10.0.0.5 GET /api/progress 500 1180
2026-11-05 09:02:30 10.0.0.8 GET /home 200 110
2026-11-05 09:03:10 10.0.0.8 GET /courses 200 360
2026-11-05 09:03:12 10.0.0.7 GET /home 200 105
2026-11-05 09:03:50 10.0.0.6 GET /api/progress 200 220
this line is not a valid log entry
2026-11-05 09:04:01 10.0.0.6 GET /home 200 98
2026-11-05 09:04:33 10.0.0.7 GET /courses/sql 200 395
2026-11-05 09:05:02 10.0.0.8 GET /missing 404 28"""

PATTERN = re.compile(
    r"^(?P<date>\d{4}-\d{2}-\d{2}) (?P<time>\d{2}:\d{2}:\d{2}) "
    r"(?P<ip>\S+) (?P<method>[A-Z]+) (?P<path>\S+) (?P<status>\d{3}) (?P<ms>\d+)$"
)

def parse(text):
    entries = []
    for line in text.splitlines():
        m = PATTERN.match(line)
        if m:
            e = m.groupdict()
            e["status"], e["ms"] = int(e["status"]), int(e["ms"])
            entries.append(e)
    return entries

entries = parse(LOG)

failed_logins = Counter(e["ip"] for e in entries if e["path"] == "/login" and e["status"] == 401)
THRESHOLD = 3

for ip, count in failed_logins.items():
    if count >= THRESHOLD:
        print(f"ALERT {ip}: {count} failed logins")

# the same IP's other activity gives context
for e in entries:
    if e["ip"] == "10.0.0.9":
        print(e["time"], e["method"], e["path"], e["status"])

Open in editor »

10.0.0.9 failed four times in 8 seconds. A real system would respond automatically (block the address, slow it down, add a captcha), but the first step is always detection, and it is just counting.

Your turn: write the code

Write suspicious(counts, limit) that takes a dictionary of failure counts per IP and returns the sorted list of IPs whose count is at least limit. Print suspicious({"a": 5, "b": 1, "c": 3}, 3).

Quick check

What pattern suggests a password-guessing attack?

Many failed logins from one IP in a short timeOne successful loginA single 404

Finish the quick check (and any code exercise) to complete this lesson, or mark it done yourself.

Tip: use the left and right arrow keys to move between lessons.