How to trap ssh breakin attempts on El Capitan
I don't believe pfctl was enabled by default in either Yosemite or El Capitan. You can still edit the /etc/pf.conf file, add rules, tables, etc., and then load and enable pfctl and you'll be up and running:

sudo pfctl -f /etc/pf.conf -e


See http://128bitstudios.com/2010/06/13/stopping-ssh-brute-force-attacks-with-pf-on-freebsd for a really simple but effective way to get an SSH rule to prevent bruteforce attacks.

Also see http://krypted.com/mac-security/a-cheat-sheet-for-using-pf-in-os-x-lion-and-up

If you want pfctl to load at boot you'll need to roll your own launchd script.

Another option is a GUI app like Murus. You can then examine the launchd file it creates and the PF files in /etc/murus and understand better how to make this work for you.