DNS sinkhole
A DNS sinkhole answers requests for a bad domain with a controlled address, so infected machines that call home reach a safe server instead. A block at a DNS filter or secure web gateway has a similar effect and is simpler. It is a network containment action that also shows which hosts are infected.
Definition
Sinkholing is useful for malware that uses domain names for command and control. The logs show which internal hosts asked for the domain.
The scorecard counts block at the proxy or DNS filter as one network action, separate from a firewall block.
DNS sinkhole in Prophet Security's documentation
Prophet Security's integrations page names Cisco Umbrella and Zscaler among its 200+ integrations, tools that can enforce a DNS or web block, with no action list for either. vendor claim prophetsecurity.ai, read
The example names a vendor and its own page. A vendor's use of DNS sinkhole may differ from the definition above; the rubric uses the definition on this page.