diff --git a/templates/etc/fail2ban/filter.d/icingaweb2-auth.conf b/templates/etc/fail2ban/filter.d/icingaweb2-auth.conf
new file mode 100644
index 0000000..3b8a946
--- /dev/null
+++ b/templates/etc/fail2ban/filter.d/icingaweb2-auth.conf
@@ -0,0 +1,7 @@
+[Definition]
+
+failregex = ^.*- <HOST> - \S+ - login-failed - User failed to authenticate$
+
+ignoreregex =
+
+datepattern = {^LN-BEG}