CrowdSec

CrowdSec is an open-source security engine for servers. An agent reads logs from services such as SSH, web servers and mail, detects behavior like brute-force attempts or scans, and passes decisions to bouncers that block the offending IP addresses at the firewall, web server or CDN. Users who share their signals receive community blocklists in return, and paid plans add more lists and a console for many machines.

It is often compared with Fail2ban, with its larger library of detection scenarios and the shared blocklists as the main differences. Before you roll it out, choose the bouncer that suits your stack, make sure monitoring and office IP addresses are allowlisted, and review what data the agent sends to the central service.