各位好

日前有作fortigate 60e的入侵偵測
然後就收到一堆嘗試登入的信件

信件主旨：Message meets Alert condition

信件內文1：
Message meets Alert condition
The following critical firewall event was detected: Admin login failed.
date=2023-08-01 time=14:05:42 devname=numax-slave devid=FGT60ETK19010000 logid="0100032002" type="event" subtype="system" level="alert" vd="root" eventtime=1690869942 logdesc="Admin login failed" sn="0" user="admin" ui="ssh(193.35.18.101)" method="ssh" srcip=193.35.18.101 dstip=61.252.25.119 action="login" status="failed" reason="ip_blocked" msg="Administrator admin login failed from ssh(193.35.18.101) because of blocked IP"

文中有寫到原因是因為ip是在黑名單中
想請教一下，該如何設定黑名單ip所作的這些操作，能否不要再寄信通知
反正都是無法成功登入的
不然每天光是收這些信件就上百封的
無法有效收到真正有問題的信件

信件內容2：
Message meets Alert condition
The following critical firewall event was detected: Admin login failed.
date=2023-08-01 time=09:35:04 devname=numax-slave devid=FGT60ETK19010000 logid="0100032002" type="event" subtype="system" level="alert" vd="root" eventtime=1690853704 logdesc="Admin login failed" sn="0" user="admin123" ui="ssh(141.98.11.11)" method="ssh" srcip=141.98.11.11 dstip=61.252.25.119 action="login" status="failed" reason="name_invalid" msg="Administrator admin123 login failed from ssh(141.98.11.11) because of invalid user name"

文中有寫到原因是因為不正確的user name
能否設定這個ip登入失敗幾次後，就加入黑名單
然後接著就會變成信件內文1的那個case

還請各位專家們指點一下了，謝謝