I manage a server running Windows Server 2008 R2 that constantly gets bombarded with brute force attacks via FTP. These failed login attempts show up in the Security section of the Windows Logs as Audit Failure errors (Event ID 4625) with a Logon Type of 8 (NetworkCleartext). In each event log entry the Source Network Address (i.e. the offending IP address that should be blocked) is never listed, however, the IP address IS listed in the FTP logs (located by default in C:\inetpub\logs\LogFiles\FTPSVC2).
Is there any way to have the offending IP addresses, which the FTP log clearly knows about, also show up in the Security Windows Logs?