import re
from collections import defaultdict

LOG_FILE = "ghaymah_access.log"
FAILED_THRESHOLD = 5

ip_failures = defaultdict(int)

log_pattern = re.compile(r'(?P<ip>\d+\.\d+\.\d+\.\d+) - - \[.*?\] "(?P<method>\w+) (?P<path>\S+) HTTP/.*?" (?P<status>\d{3})')

try:
    with open(LOG_FILE, 'r') as f:
        for line in f:
            match = log_pattern.search(line)
            if match:
                data = match.groupdict()
                if data['status'] == '401' and '/login' in data['path']:
                    ip_failures[data['ip']] += 1
                    if ip_failures[data['ip']] >= FAILED_THRESHOLD:
                        print(f"[ALERT] High Brute Force Risk: {data['ip']} ({ip_failures[data['ip']]} failed attempts)")
                if "select" in data['path'].lower() or "union" in data['path'].lower():
                    print(f"[CRITICAL] Potential SQL Injection from {data['ip']}: {data['path']}")
except FileNotFoundError:
    print(f"Log file {LOG_FILE} not found. Ready for deployment.")