diff --git a/MANIFEST b/MANIFEST
index a8195b54..98a98532 100644
--- a/MANIFEST
+++ b/MANIFEST
@@ -59,6 +59,7 @@ testcases/files/logs/assp
 testcases/files/logs/asterisk
 testcases/files/logs/dovecot
 testcases/files/logs/exim
+testcases/files/logs/groupoffice
 testcases/files/logs/suhosin
 testcases/files/logs/mysqld-auth
 testcases/files/logs/named-refused
@@ -181,6 +182,7 @@ config/filter.d/3proxy.conf
 config/filter.d/apache-common.conf
 config/filter.d/exim-common.conf
 config/filter.d/exim-spam.conf
+config/filter.d/groupoffice.conf
 config/filter.d/perdition.conf
 config/filter.d/uwimap-auth.conf
 config/action.d/apf.conf
diff --git a/config/filter.d/groupoffice.conf b/config/filter.d/groupoffice.conf
new file mode 100644
index 00000000..d5a4e4d8
--- /dev/null
+++ b/config/filter.d/groupoffice.conf
@@ -0,0 +1,14 @@
+# Fail2Ban filter for Group-Office
+#
+# Enable logging with:
+# $config['info_log']='/home/groupoffice/log/info.log';
+#
+
+[Definition]
+
+failregex = ^\[\]LOGIN FAILED for user: "\S+" from IP: <HOST>$
+
+
+
+# Author: Daniel Black
+
diff --git a/testcases/files/logs/groupoffice b/testcases/files/logs/groupoffice
new file mode 100644
index 00000000..7809f018
--- /dev/null
+++ b/testcases/files/logs/groupoffice
@@ -0,0 +1,4 @@
+# failJSON: { "time": "2014-01-06T10:59:38", "match": true, "host": "127.0.0.1" }
+[2014-01-06 10:59:38]LOGIN FAILED for user: "asdsad" from IP: 127.0.0.1
+# failJSON: { "time": "2014-01-06T10:59:49", "match": false, "host": "127.0.0.1" }
+[2014-01-06 10:59:49]LOGIN SUCCESS for user: "admin" from IP: 127.0.0.1