Log Analysis Using Python
In this case, I will create a simple script using Python to analyze a log activity use case with the goal of detecting suspicious activity, specifically a brute-force attack, based on its occurrence patterns.
Scenario
The Security Operations Center (SOC) has detected suspicious activity that may indicate a potential brute-force login attack targeting one of the organization’s systems. During routine monitoring of security events and authentication activities, the SOC identified multiple repeated login attempts that appear abnormal and could be an indication that an attacker is trying to gain unauthorized access by systematically attempting different password combinations. As part of the investigation process, the monitoring system automatically records and stores authentication logs generated by these login attempts. These logs are captured in a structured format to help analysts review the activity, identify patterns of failed logins, and determine whether the behavior truly represents a brute-force attack or a false positive. The recorded log entries are presented in the following format:
Question:
Write a simple script or describe the logic in pseudocode to analyze login logs and detect suspicious activity. The script should identify IP addresses that generate an unusually high number of failed login attempts within a certain period. Any IP address that exceeds the defined threshold should be flagged as suspicious and considered for blacklisting to prevent potential brute-force attacks.
Expectations:
- The solution can be written using any programming language such as Python, Bash, or presented in pseudocode.
- The main priority is demonstrating clear and understandable logic rather than perfect syntax.
- The analysis should focus on identifying: Repeated failed login attempts indicated by HTTP 401 responses on the
/loginendpoint, Suspicious patterns using threshold-based detection, for example detecting an IP address that generates X number of failed login attempts within Y period of time.
Answer
Based on the captured logs, the analysis indicates potential brute-force activity originating from multiple IP addresses, specifically (111.222.333.123, 444.555.666.777, and 444.555.666.999). Further investigation reveals that one of these IP addresses generated repeated login attempts that resulted in HTTP 401 (Unauthorized) responses, indicating failed authentication attempts during the login process. A potential brute-force login attempt was identified through the analysis of repeated failed login requests (HTTP 401) targeting the /login endpoint.
These repeated authentication failures from the same IP indicate suspicious behavior consistent with a brute-force attack pattern.
Another IP address, 444.555.666.999, only performed a single failed login attempt and therefore does not meet the threshold to be considered malicious.
Meanwhile, IP 111.222.333.123 shows successful access to multiple endpoints (/index, /login, /contact) with HTTP 200 responses, indicating normal user behavior and no sign of brute-force activity.
Based on this analysis, 444.555.666.777 should be flagged for further investigation or temporary blocking.
Get Naelzi’s stories in your inbox
Join Medium for free to get updates from this writer.
The following is a simple Python script used to identify log entries that should be flagged as potentially indicative of brute-force activity by applying a threshold-based detection approach.
logs = [
“1532926994 111.222.333.123 GET /index 200”,
“1532927014 444.555.666.777 POST /login 401”,
“1532927240 444.555.666.777 POST /login 401”,
“1532927335 111.222.333.123 GET /faq 404”,
“1532927338 111.222.333.123 GET /login 200”,
“1532927339 111.222.333.123 GET /contact 200”,
“1532927500 111.222.333.123 GET /login 200”,
“1532927575 444.555.666.999 POST /login 401”
]
FAILED_THRESHOLD = 2
TIME_WINDOW = 300
failed_attempts = {}
# Step 1 collect failed login timestamps per IP
for log in logs:
timestamp, ip, method, url, status = log.split()
timestamp = int(timestamp)
if url == “/login” and status == “401”:
if ip not in failed_attempts:
failed_attempts[ip] = []
failed_attempts[ip].append(timestamp)
print(“Suspicious IPs detected:”)
# Step 2 simple time window check
for ip in failed_attempts:
times = sorted(failed_attempts[ip])
if len(times) >= FAILED_THRESHOLD:
if times[FAILED_THRESHOLD — 1] — times[0] <= TIME_WINDOW:
print(f”{ip} -> {FAILED_THRESHOLD} failed logins within {TIME_WINDOW} seconds”)
Output
The above program performs log identification by extracting several key variables, including timestamp, IP address, method, and endpoint (URL). In the initial stage, the log data is stored in a list named logs, which contains the collection of log entries to be analyzed.
Next, detection rules are defined to identify brute-force patterns based on the available logs by setting a failed login threshold of two attempts and a time window of 300 seconds. These rules are used to detect potential brute-force activity based on repeated failed login attempts occurring within a short period of time. The threshold and time window values are adjusted according to the characteristics of the analyzed log data.
During the parsing stage, the system processes each log entry to extract the IP address and timestamp of failed login attempts. This information is then stored in the failed_attempts data structure, where each IP address has its own list to record failed login timestamps. If the same IP appears multiple times with several failed login attempts within a short time frame, the IP is considered suspicious.
Finally, the system applies time window analysis by sorting the failed login timestamps for each IP stored in failed_attempts. If the number of failed login attempts reaches or exceeds the defined threshold, and the time difference between the first failed login and the X-th failed login falls within the specified time window, the IP is identified as a potential brute-force activity.
1. How would this detection appear in a SIEM?
Answer:
In a SIEM platform, this detection would appear as a correlation alert triggered by multiple failed login events (HTTP 401) to the /login endpoint from the same source IP within a defined time window. The alert would typically include key details such as source IP address, number of failed attempts, affected endpoint, timestamps, and severity level, and would be categorized as a potential brute-force login attempt.
2. What would you do before permanently blacklisting an IP?
Answer:
Before permanently blacklisting an IP, I would first review the alert and create a ticket to ensure the activity is properly tracked and triaged. At a low threshold, such as two failed login attempts, I would not immediately apply a permanent block because this could still be a false positive:
· I would analyze whether the IP belongs to a legitimate user, an internal network, or a known VPN.
· Review the login activity history to see if the attempts continue or stop.
· I would also check for suspicious patterns such as rapid requests, multiple usernames, unusual user-agents, or a successful login after repeated failures.
If the behavior remains suspicious but is not severe, I would recommend temporary mitigation such as rate limiting or captcha to reduce risk without disrupting legitimate users. A permanent blacklist would only be applied if there is clear evidence of sustained or escalating malicious activity.
