I use Crowdsec in all my servers. In the most basic level it's a fail2ban replacement with crowd sourced and more intelligent event detection.
You basically feed it logs and it parses, analizes, enriches and correlates the data. And if it determines there's a threat it blocks the IP using ipset. There are also other remediation components.
When I tested it with open panel I could only analize ssh events. I could not configure the nginx, apache or LiteSpeed parsers since I didn't know where these logs were located in order to feed them to Crowdsec.
It also has the ability to read these logs from the docker container if the logs are available when doing docker compose logs. For example I'm reading postfix and dovecot logs in a mailcow instance by doing:
docker compose logs postfix-mailcow
And Crowdsec has the ability to read and parse them and detect various mail related threads.
I wish I had more expertise on all these things to explain it better. And also the language barrier is not helping.
I believe it would be very positive to have Crowdsec working in with open panel. Or at least have the logs more centrally available for Crowdsec to ingest.