I would like to block an IP in the firewall windows 2008 server, if my event viewer announce 10 unsuccessful attempts to login.
Detailing the issue.
My event viewer always shows brute force attempts to access the RDP (login: administrator, alpha, 1administrator), Sql Server 2008 (login: sa), etc..
As the attached screenshot you can see that every second the User IP: 66.36.xxx.xxx is trying by brute force, access my server with the sa login, and several consecutive invalid passwords.
In this case, I manually have to add this IP to my firewall rule of the windows, which I called "Hacker Attack".
My question is, how do I get this IP is attacking me by brute force, to enter the IP block list in my rule, "Hacker Attack" on my firewall windows 2008 server?
I like to do this automatically, every 10 invalid login attempts on the server.
