Fail2ban is a log-monitoring intrusion prevention tool that scans log files, such as those generated by SSH or web server authentication, for patterns indicating repeated failed login attempts. When a configured threshold of failures from a specific IP address is reached within a defined time window, Fail2ban dynamically inserts a firewall rule (via iptables, nftables, or another supported backend) to temporarily block that IP address, helping to mitigate brute-force attacks without requiring permanent manual firewall configuration.