mscy26010/siem ? reverse-engineered prompt

Build me a lightweight Python SIEM app that can read in log files, normalize the messy text into clean JSON style events, and then flag suspicious activity. It should understand common SSH and web server logs, catch repeated failed logins from the same IP in a short time window, and spot obvious SQL injection style requests like UNION SELECT or 1=1 patterns.

I want a simple main script I can run to test the full flow end to end, plus a small dashboard or console output that shows what was detected and why. Keep the detection rules easy to tweak from a config file, and make the code modular so the parsing, correlation, and alerting parts are separated cleanly. Use the sample logs if they help, and if you need to check current Python library docs online, go ahead.