diff --git a/config/filter.d/bitwarden.conf b/config/filter.d/bitwarden.conf
new file mode 100644
index 00000000..4cebcedf
--- /dev/null
+++ b/config/filter.d/bitwarden.conf
@@ -0,0 +1,9 @@
+# Fail2Ban filter for Bitwarden
+# Detecting failed login attempts
+# Logged in bwdata/logs/identity/Identity/log.txt
+
+[Init]
+datepattern = ^%%Y-%%m-%%d %%H:%%M:%%S
+
+[Definition]
+failregex = ^.*Failed login attempt(, 2FA invalid)\. <HOST>$