Firewall block
A firewall block adds an IP address, domain or URL to a deny list or address group on a firewall, so traffic to or from it stops. It is the main network containment action. It is easy to run and easy to overuse, since a wide block can cut off legitimate services.
Definition
Block lists need expiry. Indicators go stale, and addresses get reused by innocent hosts. Ask whether the platform can set an expiry and remove the block later.
Firewall products differ in how they take rules, by object group, by tag or by policy push. The action list should name the product.
Firewall block in D3 Security's documentation
D3 Security's platform page names Fortinet and Zscaler among its integrations alongside Splunk, Sentinel, CrowdStrike, SentinelOne and Okta, without an action-level list that shows which block actions exist. vendor claim d3security.com, read
The example names a vendor and its own page. A vendor's use of Firewall block may differ from the definition above; the rubric uses the definition on this page.