diff --git a/config/filter.d/sogo-auth.conf b/config/filter.d/sogo-auth.conf
new file mode 100644
index 00000000..e4d29c23
--- /dev/null
+++ b/config/filter.d/sogo-auth.conf
@@ -0,0 +1,19 @@
+# /etc/fail2ban/filter.d/sogo.conf
+#
+# Fail2Ban configuration file
+# By Arnd Brandes
+# SOGo
+#
+
+[Definition]
+# Option: failregex
+# Filter Ban in /var/log/sogo/sogo.log
+# Note: the error log may contain multiple hosts, whereas the first one 
+# is the client and all others are poxys. We match the first one, only
+
+failregex = Login from '<HOST>.*' for user '.*' might not have worked
+
+# Option: ignoreregex
+# Notes.: regex to ignore. If this regex matches, the line is ignored.
+# Values: TEXT
+#