- Critical (Red): Immediate threats requiring urgent action. Automatic blocking triggered, email alerts sent.
- High (Orange): Potentially dangerous patterns requiring monitoring. Multiple failed attempts from same IP.
- Medium (Green): Suspicious but not immediately dangerous activity.
- Low (Yellow): Normal security-related activities and routine checks.
