You could take a look at fail2ban, which is directly contained in the repos (so you can simply "sudo apt-get install fail2ban"). I use it for years now, and it kept a lot of hackers out of my server by blocking them. Fail2ban works by parsing log files for specified patterns (it ships with a good sample config), and then blocking the attackers IP -- e.g. if a hacker made 5 failed attempts to login via ssh (even to different accounts), you can have his IP blocked for a specified length of time (e.g. 30min). There are examples shipped for different services, just take a look at the homepage for additional information.
Edit: Notifications are also possible (send a mail if something was detected).