Active response: automatically block an attacker

Objective

Take Wazuh from detection to action: when an SSH brute force rule fires, the attacker's address is blocked by the firewall for a limited time. You also learn how to avoid the worst: blocking your own administration access.