Fail2ban
/etc/fail2ban/filter.d/checkmk.conf [Definition] failregex = .* \[cmk_security\.auth \d+\] \{"summary": "authentication failed".*"remote_ip": "<HOST>".* ignoreregex =
sudo fail2ban-regex /path/to/your/checkmk/var/log/security.log /etc/fail2ban/filter.d/checkmk.conf
/etc/fail2ban/jail.local
[checkmk]
enabled = true
filter = checkmk
logpath = /path/to/your/checkmk/var/log/security.log
maxretry = 3
bantime = 3600
findtime = 600
backend = auto
systemctl reload fail2ban
fail2ban-client status checkmk