This article explores how I designed and built the detection engine behind a distributed automated IP blocking platform using Graylog. By centralising logs from multiple Docker Swarm nodes, correlating suspicious HTTP activity across the entire infrastructure, and identifying reconnaissance patterns instead of isolated events, the platform can detect malicious behaviour in real time. This detection layer forms the foundation of an automated response system that blocks persistent attackers across every server in the cluster while minimising false positives.