Under the Realm settings > Security defenses > Brute force detection tab, click the Enabled toggle to enforce security around multiple login attempts and to reveal more options with which to harden your system around brute force attacks.
The Max login failures setting allows you to place a maximum number of password attempts a user can submit before being locked out of the system. You can additionally set the lockout duration (using the Max wait field), the maximum amount of time in between failed attempts (using the Wait increment field), the amount of time after which a failure is reset (using the Failure reset time field), and make lockouts permanent with the Permanent lockout toggle.