fail2ban/config/filter.d/bitwarden.conf

# Fail2Ban filter for Bitwarden
# Detecting failed login attempts
# Logged in bwdata/logs/identity/Identity/log.txt

[INCLUDES]
before = common.conf

[Definition]
_daemon = Bitwarden-Identity
failregex = ^%(__prefix_line)s\s*\[(?:W(?:RN|arning)|Bit\.Core\.[^\]]+)\]\s+Failed login attempt(?:, 2FA invalid)?\. <ADDR>$

# DEV Notes:
# __prefix_line can result to an empty string, so it can support syslog and non-syslog at once.
Create bitwarden.conf 5 years ago			`# Fail2Ban filter for Bitwarden`
			`# Detecting failed login attempts`
			`# Logged in bwdata/logs/identity/Identity/log.txt`

Add Bitwarden syslog support 4 years ago			`[INCLUDES]`
			`before = common.conf`

Create bitwarden.conf 5 years ago			`[Definition]`
review and small tweaks (more precise and safe RE) 4 years ago			`_daemon = Bitwarden-Identity`
			`failregex = ^%(__prefix_line)s\s*\[(?:W(?:RN\|arning)\|Bit\.Core\.[^\]]+)\]\s+Failed login attempt(?:, 2FA invalid)?\. <ADDR>$`
Add Bitwarden syslog support 4 years ago
			`# DEV Notes:`
			`# __prefix_line can result to an empty string, so it can support syslog and non-syslog at once.`