Check out what I made: A simple script that alerts on failed login attempts to the firewall itself.

You’d think this would be a standard feature. It's not.

Most next-gen firewall dashboards bury this or make you pay for the "advanced" threat module just to see failed admin logins in real time. So I wrote a script that polls the local logs and sends an alert. No cloud subscription required.

* Parses the local syslog for authentication failures.
* Filters out the noise (like user timeouts vs actual brute force).
* Sends a simple email or webhook alert after X failures in Y minutes.

Surprised how many vendors charge extra for this basic security hygiene. What are they logging all that data for if not to tell you when you're under attack?