# Cybersecurity internship projects: explain an alert, not just a tool

## Five failure rows, but only two failed events

Synthetic ingestion case for one account. The source supplies stable event IDs. The review rule requires at least four distinct failures in the ten minutes before success.

### Events and repeated imports

| Source event ID | Time, UTC | Outcome | Copies in the input |
| --- | --- | --- | --- |
| E1 | 09:00 | Failure | 4 |
| E2 | 09:00 | Failure | 1 |
| E3 | 09:04 | Success | 1 |

## Your turn

How many failure rows and distinct failed events are there? Would deduplicating only by account and timestamp be correct?

## Your answer

[Write your approach here.]

## For your own application

Test repeated imports and distinct events with equal timestamps as separate cases.

Return to the guide for the worked answer and source notes:
https://internshipdeadlines.com/guides/cybersecurity-internship-projects