simple parse tool for WP sucuri Plugin (grabs failed logins so they can be added to a firewall)

sucuri-failedlogins2pf.py

#!/usr/bin/env python
import sys
import json

filename = sys.argv[1]
data = []
limit_attempts = 2

f = open(filename, 'r').readlines()
f.pop(0)

for line in f:
    data.append(json.loads(line))

# Debug
# data = json.dumps(data, indent=4, sort_keys=True)

blockList = []
def addToBlockList(ipAddr):
    # For now this just prints the ips, but I can use the pf module latter.
    # Or maybe another firewall!?
    blockList.append(ipAddr)

def checkRepeat():
    ipAddrList = {}
    for item in data:
        ipAddr = item['remote_addr']
        user = item['user_login']
        user_agent = item['user_agent']
        attempt_time = item['attempt_time']

        if ipAddr not in ipAddrList:
            ipAddrList[ipAddr] = []
        details = [user, user_agent, attempt_time]
        ipAddrList[ipAddr].append(details)

    for ipAddr, details in ipAddrList.items():
            if len(details) > limit_attempts:
                print("Found %s failed login attempts for the same IP\ Address (%s)" % (len(details), ipAddr))
                print details
                addToBlockList(ipAddr)
            else:
                print("Attempt with IP(%s) also detectd but does not exceed limit(%s)" % (ipAddr,limit_attempts))

checkRepeat()

for i in blockList:
    print i,