Managing Repeat Offender in OSSEC

In ossec.conf:

<active-response>
    <repeated_offenders>60,120,1440</repeated_offenders>
 </active-response>

where 60, 120, 1440 indicate minutes banned after first, second, and third offense. Adapt these values to your taste.