Yes, this is possible using Tcl. The best way to do this would be to react to each "deny" syslog and store the host in an EEM context. When the specific host hits your threshold then you send the email. The time-based thing adds a bit of a challenge. What might be best is to cycle the context every time the script is invoked (i.e., everytime a syslog message is generated). That is, check each host in the cache and find out if the last time a deny was seen from it is within your allowed time frame. If not, delete the host entry.
