Interview Guides
Given a list of log lines, parse each line and return a summary of suspicious IPs and slow endpoints. Each log line has the format timestamp ip method path status latency_ms. An IP is suspicious if it has at least failed_threshold responses with status 401 or 403. A path is slow if its average latency is at least slow_threshold milliseconds. Return a dictionary with suspicious IPs sorted by descending failure count, and slow paths sorted lexicographically.
1 <= len(logs) <= 10^5100 <= status <= 5990 <= latency_ms <= 10^61 <= failed_threshold <= 10^51 <= slow_threshold <= 10^6
