Build a rule-based criteria using the percentage difference from the median that flags an IP address if the failures and attempts are both five times their respective medians, or if the distinct...

Build a rule-based criteria using the percentage difference from the median that

flags an IP address if the failures and attempts are both five times their respective

medians, or if the distinct usernames count is five times its median. Be sure to use

a one-hour window. Remember to use the get_baselines() function to

calculate the metrics needed for the baselines.