Parse Logs for Incidents | Dataford Interview Questions

Write a function to parse log files and identify security incidents.

Each log entry is a string formatted as timestamp|ip_address|event, where timestamp is an integer and event is LOGIN_FAILED, LOGIN_SUCCESS, or another event. Return a lexicographically sorted list of IP addresses with at least three LOGIN_FAILED events within any 300-second inclusive window. Logs may be unsorted. Assume every input entry is well-formed.

Function: identify_incidents(logs). Return [] when no incident exists.

Constraints

1 <= logs.length <= 10^4
Each log entry has the format timestamp|ip_address|event
0 <= timestamp <= 10^9
The IP address contains no pipe characters
An incident requires at least three LOGIN_FAILED events within 300 inclusive seconds
Return each incident IP only once

Function Signature

def identify_incidents(logs):

Your question is Parse Logs for Incidents. Start with the requirements in the Question tab.

Run and submit as often as you like. When you're ready, talk me through your approach or go straight to the code.

Problem

Write a function to parse log files and identify security incidents.

Function: identify_incidents(logs). Return [] when no incident exists.

Constraints

1 <= logs.length <= 10^4
Each log entry has the format timestamp|ip_address|event
0 <= timestamp <= 10^9
The IP address contains no pipe characters
An incident requires at least three LOGIN_FAILED events within 300 inclusive seconds
Return each incident IP only once

Function Signature

def identify_incidents(logs):

Your question is Parse Logs for Incidents. Start with the requirements in the Question tab.

Run and submit as often as you like. When you're ready, talk me through your approach or go straight to the code.