The 30-Line Script That Ended a 2 AM Alert Flood

from collections import defaultdict
from datetime import timedelta

WINDOW = timedelta(minutes=10)
THRESHOLD = 5

def flag_bruteforce(events):
# events: list of (timestamp, source_ip) tuples, already sorted by time
recent = defaultdict(list)
flagged = {}
for ts, ip in events:
recent[ip] = [t for t in recent[ip] if ts - t < WINDOW] + [ts]
if len(recent[ip]) >= THRESHOLD:
flagged[ip] = len(recent[ip])
return flagged