Can FAZ update a threat feed based on FAC logs for "AUTH_FAIL_NOUSER"?

Hello,

I'm pretty new to FAZ but we were sold on it based on it's ability to trigger actions based on log events.  Now that we have it, I'm not sure it can do what I had planned though.

Problem:  We're trying to phase-out SSL-VPN but can't right now.  We see constant attempts from certain subnets trying random user-names to log in that we'd like to block, but we don't want to block legitimate users that may have mistyped they're username.  The FAC log we see for this is "AUTH_FAIL_NOUSER" in the Log Description field.

Solution:  I'd like to detect instances of "AUTH_FAIL_NOUSER" and note the <User IP>.  If the User IP makes more than 5 attempts in 5hrs.  Add that IP to a threat feed (maybe on FMG), or at least send an alert.

Currently I'm doing this manually by checking the logs whenever I have time, and adding it to a threat feed we host on an internal github server.

I was trying to search for a solution like this but haven't come across one yet.