{
  "license": "CC BY 4.0",
  "recipe": {
    "slug": "suspicious-authentication-bursts",
    "title": "Detect Suspicious Authentication Bursts",
    "testedWith": "Apache DataFusion 45.2.0",
    "lastReviewed": "2026-07-28"
  },
  "contract": {
    "tableName": "authentication_events",
    "schema": [
      {
        "name": "timestamp_utc",
        "type": "Timestamp",
        "description": "Authentication outcome time."
      },
      {
        "name": "actor_id",
        "type": "Utf8",
        "description": "Privacy-safe actor identifier."
      },
      {
        "name": "network_bucket",
        "type": "Utf8",
        "description": "Approved coarse network or risk bucket."
      },
      {
        "name": "authentication_method",
        "type": "Utf8",
        "description": "Controlled authentication method."
      },
      {
        "name": "outcome",
        "type": "Utf8",
        "description": "success or failed."
      }
    ]
  },
  "query": "SELECT\n  date_trunc('hour', timestamp_utc) AS hour,\n  network_bucket,\n  authentication_method,\n  COUNT(*) AS attempts,\n  SUM(CASE WHEN outcome = 'failed' THEN 1 ELSE 0 END) AS failures,\n  COUNT(DISTINCT actor_id) AS targeted_actors\nFROM authentication_events\nWHERE timestamp_utc >= now() - INTERVAL '24 hours'\nGROUP BY date_trunc('hour', timestamp_utc), network_bucket, authentication_method\nHAVING SUM(CASE WHEN outcome = 'failed' THEN 1 ELSE 0 END) >= 20\nORDER BY failures DESC, targeted_actors DESC;",
  "fixtureKind": "schema-example",
  "inputRows": [
    {
      "timestamp_utc": "2026-07-28T10:00:00Z",
      "actor_id": "actor_id_example_1",
      "network_bucket": "network_bucket_example_1",
      "authentication_method": "authentication_method_example_1",
      "outcome": "success"
    },
    {
      "timestamp_utc": "2026-07-28T11:00:00Z",
      "actor_id": "actor_id_example_2",
      "network_bucket": "network_bucket_example_2",
      "authentication_method": "authentication_method_example_2",
      "outcome": "failed"
    },
    {
      "timestamp_utc": "2026-07-28T12:00:00Z",
      "actor_id": "actor_id_example_3",
      "network_bucket": "network_bucket_example_3",
      "authentication_method": "authentication_method_example_3",
      "outcome": "success"
    }
  ],
  "illustrativeInputRows": [
    {
      "timestamp_utc": "2026-07-28T10:00:00Z",
      "actor_id": "actor_id_example_1",
      "network_bucket": "network_bucket_example_1",
      "authentication_method": "authentication_method_example_1",
      "outcome": "success"
    },
    {
      "timestamp_utc": "2026-07-28T11:00:00Z",
      "actor_id": "actor_id_example_2",
      "network_bucket": "network_bucket_example_2",
      "authentication_method": "authentication_method_example_2",
      "outcome": "failed"
    },
    {
      "timestamp_utc": "2026-07-28T12:00:00Z",
      "actor_id": "actor_id_example_3",
      "network_bucket": "network_bucket_example_3",
      "authentication_method": "authentication_method_example_3",
      "outcome": "success"
    }
  ],
  "expectedOutput": {
    "columns": [
      "hour",
      "network_bucket",
      "authentication_method",
      "attempts",
      "failures",
      "targeted_actors"
    ],
    "rows": [
      {
        "hour": "2026-07-28 18:00",
        "network_bucket": "risk-proxy",
        "authentication_method": "password",
        "attempts": 480,
        "failures": 451,
        "targeted_actors": 206
      },
      {
        "hour": "2026-07-28 19:00",
        "network_bucket": "unknown-datacenter",
        "authentication_method": "password",
        "attempts": 122,
        "failures": 104,
        "targeted_actors": 11
      }
    ]
  },
  "notes": [
    "The compact input rows demonstrate field names and JSON types; they are not claimed to generate the displayed aggregate by themselves.",
    "The expected output is deterministic synthetic review data for the documented output shape.",
    "Adapt time windows, thresholds, identities, and business definitions before operational use."
  ]
}