Comment by Furqan Ashraf on "Threat Atlas Lab 01: Building a Failed Login Detection Tool with Python"

CommentThreat Atlas Lab 01: Building a Failed Login Detection Tool with Python

Furqan Ashraf

We are small team, who loves to code.

For the time window on your next-steps list, a collections.deque per IP keeps it simple: append each failure's timestamp, pop from the left while the oldest is outside the window, and alert when len() reaches 5. Then your three tests are just 4, 5 and 6 failures inside the window, plus 6 spread across two windows that should not alert.

Small heads-up for later: 203.0.113.0/24 is a documentation range (RFC 5737), so if you add a geolocation or reputation lookup in a future lab, those test IPs will come back empty. Use a few real public IPs in a separate test file for that step.

Mukaddaskhon Umarova

1d ago

Hello! Thank you for the thoughtful suggestions. I really like the idea of using collection. deque to introduce a rolling time window. It would make the detection logic more practical by focusing on repeated failures within a specific period rather than simply counting all failures.

I'll work on implementing the four test scenarios (4, 5, and 6 attempts within the window, plus 6 attempts spread across separate windows) and document the results in the next version of the lab.

Also, thanks for pointing out the RFC 5737 documentation IP range. I'll keep the synthetic IPs for the current tests and consider using a separate set of public IPs if I introduce geolocation or reputation checks in a future lab.

Appreciate it buddy~

Four, yes, I miscounted. A couple of things that might save you time in Lab 02:

You mentioned field names and encoding tripping you up. If the CSV was ever saved from Excel, it probably has a BOM, so the first header gets read as \ufefftimestamp instead of timestamp. Opening the file with encoding="utf-8-sig" fixes that quietly.

Once the window is in, sort the rows by timestamp before you process them, because the deque logic assumes events arrive in order. Also keep a set of IPs you’ve already alerted on. Otherwise an IP like 203.0.113.25 with 7 failures prints three alerts (at 5, 6 and 7) instead of one.

Looking forward to the repo.

Search Hashnode