Nice minimal approach. One design point: the threshold counts failures over the entire file, so a slow trickle across weeks looks the same as a burst of 50 attempts in a minute. Bucketing timestamps into a sliding window (for example a deque per IP, evicting entries older than N minutes) would separate those cases. Note the syslog timestamp has no year, which can bite around January rollovers. Also, 'Invalid user' and 'Failed password' lines are separate events in sshd logs, and distributed attacks spread across many IPs would evade a per-IP counter, so grouping by username might be a useful second view. Would you consider tracking successful logins following a failure streak from the same IP?