# /etc/fail2ban/filter.d/cioclub.conf — reads storage/logs/security.log written by the app
[Definition]
failregex = ^\S+ (AUTH_FAIL|AUTH_LOCK|MFA_FAIL|MFA_LOCK|CSRF_FAIL) ip=<HOST>(\s|$)
ignoreregex =