Parsing Audit Logs for Anomalies | Dataford Interview Questions

Write a script or function to parse large cloud audit logs and flag anomalous access patterns.

Each input line has the format timestamp,user_id,ip,action, with integer timestamps in nondecreasing order. Return the zero-based indices of events where the user has accessed from more than max_unique_ips distinct IP addresses within the inclusive preceding window_seconds interval. Inputs are valid, and the result must preserve log order.

Constraints

1 <= len(log_lines) <= 1000000
Each line contains exactly four comma-separated fields: timestamp, user_id, ip, action
Timestamps are nonnegative integers in nondecreasing order
0 <= window_seconds <= 1000000000
0 <= max_unique_ips <= 100000
User IDs, IP addresses, and actions are nonempty strings

Function Signature

def flag_anomalous_access(log_lines, window_seconds, max_unique_ips):

Your question is Parsing Audit Logs for Anomalies. Start with the requirements in the Question tab.

Run and submit as often as you like. When you're ready, talk me through your approach or go straight to the code.

Problem

Write a script or function to parse large cloud audit logs and flag anomalous access patterns.

Constraints

1 <= len(log_lines) <= 1000000
Each line contains exactly four comma-separated fields: timestamp, user_id, ip, action
Timestamps are nonnegative integers in nondecreasing order
0 <= window_seconds <= 1000000000
0 <= max_unique_ips <= 100000
User IDs, IP addresses, and actions are nonempty strings

Function Signature

def flag_anomalous_access(log_lines, window_seconds, max_unique_ips):

Your question is Parsing Audit Logs for Anomalies. Start with the requirements in the Question tab.

Run and submit as often as you like. When you're ready, talk me through your approach or go straight to the code.