01 / The problem
Identify repeated failed logins followed by a successful login without treating every match as a confirmed compromise.
02 / Technical environment
Local Python detector with fictional login records; no live SIEM integration.
03 / Investigation
The rule groups events by source, account and host and evaluates a five-minute window.
04 / Tools used
Python standard library, synthetic events and recorded unit tests.
05 / Findings
Saved input produces two alerts. User mistakes, NAT and shared devices remain alternative explanations.
06 / Implemented changes
A local event-window detection component with a documented investigation workflow.
07 / Testing and verification
The saved test record contains six authentication checks. Live log collection remains a future step.
08 / Results and limitations
A repeatable local exercise. Live Windows/Linux log collection and an investigated SIEM alert remain future work.
09 / Lesson
Detection logic needs context. A matched rule is evidence to examine, not a verdict.