Modsecurity rules to avoid brute force attack

Question

I have two websites.

http://example1.com/project1/login.php 

http://example2.com/project2/login.php

Both need to log in to use. And they sen