Parsing Audit Logs for Anomalies

MediumPython00:00

Practice interviewer

In session

5 left

00:00

Your question is Parsing Audit Logs for Anomalies. Start with the requirements on the right.

Run and submit as often as you like. When you're ready, talk me through your approach or go straight to the code.

You need to log in / sign up to run or submit.

Problem

Write a script or function to parse large cloud audit logs and flag anomalous access patterns.

Each input line has the format timestamp,user_id,ip,action, with integer timestamps in nondecreasing order. Return the zero-based indices of events where the user has accessed from more than max_unique_ips distinct IP addresses within the inclusive preceding window_seconds interval. Inputs are valid, and the result must preserve log order.

Constraints

1 <= len(log_lines) <= 1000000
Each line contains exactly four comma-separated fields: timestamp, user_id, ip, action
Timestamps are nonnegative integers in nondecreasing order
0 <= window_seconds <= 1000000000
0 <= max_unique_ips <= 100000
User IDs, IP addresses, and actions are nonempty strings

Function Signature

def flag_anomalous_access(log_lines, window_seconds, max_unique_ips):

Your solutionPython 3

You need to log in / sign up to run or submit.

Run your code to see test output