Sliding Window Log Parsing | Dataford Interview Questions

Write a function to parse a stream of system logs and extract key security indicators within a sliding time window for Abnormal AI.

Implement extract_security_indicators(logs, window_seconds, threshold). Each log is a string in timestamp|actor|event format. Logs are ordered by nondecreasing timestamp. Count only FAILED_LOGIN, SUSPICIOUS_LINK, and MALWARE events for each actor. When an actor reaches the threshold within the inclusive window [timestamp - window_seconds, timestamp], return an indicator with that timestamp, actor, and count. Emit at most one indicator per actor, at the first time the threshold is reached.

Return indicators in processing order.

Constraints

0 <= logs.length <= 10^5
Each log has the format timestamp|actor|event
Timestamps are integers in nondecreasing order
0 <= window_seconds <= 10^9
1 <= threshold <= 10^5
Actor names and event names are nonempty strings

Function Signature

def extract_security_indicators(logs, window_seconds, threshold):

Your question is Sliding Window Log Parsing. Start with the requirements in the Question tab.

Run and submit as often as you like. When you're ready, talk me through your approach or go straight to the code.

Problem

Write a function to parse a stream of system logs and extract key security indicators within a sliding time window for Abnormal AI.

Return indicators in processing order.

Constraints

0 <= logs.length <= 10^5
Each log has the format timestamp|actor|event
Timestamps are integers in nondecreasing order
0 <= window_seconds <= 10^9
1 <= threshold <= 10^5
Actor names and event names are nonempty strings

Function Signature

def extract_security_indicators(logs, window_seconds, threshold):

Your question is Sliding Window Log Parsing. Start with the requirements in the Question tab.

Run and submit as often as you like. When you're ready, talk me through your approach or go straight to the code.