I run OSSEC that comes with automatic responses for common SSH authentication events