Fail2ban actions represent security events where IP addresses are banned or monitored due to suspicious activity. These actions are automatically generated when fail2ban detects attack patterns such as brute force login attempts.
serverstringThe UID of the server where the fail2ban action occurred.
addressstringThe IP address that triggered the fail2ban action.
countrystringThe country name associated with the IP address. May be null for private or internal IP addresses.
country_codestringThe ISO country code for the IP address. May be null for private or internal IP addresses.
attackstringThe type of attack that triggered the ban (e.g., SSH, HTTP, FTP).
portintegerThe network port involved in the attack. May be null if not applicable.
bannedbooleanWhether the IP address is currently banned by fail2ban.
action_datedatetimeThe timestamp when the action occurred, in ISO 8601 format.
Example
{
"server": "550e8400-e29b-41d4-a716-446655440000",
"address": "192.168.1.45",
"country": "United States",
"country_code": "US",
"attack": "SSH",
"port": 22,
"banned": true,
"action_date": "2024-02-15T14:23:41Z"
}