February 18, 2018
Managing Repeat Offender in OSSEC
In ossec.conf:
<active-response> <repeated_offenders>60,120,1440</repeated_offenders> </active-response>
where 60, 120, 1440 indicate minutes banned after first, second, and third offense. Adapt these values to your taste.