HESK already has brute force protection, under Settings —> Help Desk —> Security. You can set the number of attempts before the ban is applied and for how long the ban should last. Admins can remove the temp ban through the Banned IPs section.