Suricata as fail2ban

This could be accomplished with something link Sagan (GitHub - quadrantsec/sagan: Sagan is a multi-threads, high performance log analysis engine. At it's core, Sagan similar to Suricata/Snort but with logs rather than network packets.).