diff --git a/config/filter.d/zoneminder.conf b/config/filter.d/zoneminder.conf
new file mode 100644
index 00000000..00da76d9
--- /dev/null
+++ b/config/filter.d/zoneminder.conf
@@ -0,0 +1,23 @@
+# Fail2Ban filter for Zoneminder login failures
+#
+
+[Definition]
+
+# patern :      [client 10.1.1.1:38022] WAR [Login denied for user "test"], referer: https://zoneminderurl/
+#
+#
+# Option:  failregex
+# Notes.:  regex to match the password failure messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
+
+
+failregex = [[]client <HOST>:\d\d\d\d\d] WAR [[]Login denied for user
+
+ignoreregex =
+
+# Notes:
+#	Tested on Zoneminder 1.29.0
+#
+# Author: John Marzella