Network containment actions
4 actions in the scorecard's Network domain: which of eighteen platforms document each against a named target, and the vendor page that shows it. Read 2026-11-03 and 2026-11-04.
4actions
The grid for this domain
- native, vendor-documented
- partner or third-party documented
- custom step only
- not documented on the pages read
| Platform | Network | |||
|---|---|---|---|---|
| Block IP or domain at the firewall | Block at the proxy or DNS filter | Disable a switch port or NAC quarantine | Add to a threat list on the NDR | |
| Cyware3 of 4 documented | Cyware: Disable a switch port or NAC quarantine, not documented | |||
| D3 Security3 of 4 documented | D3 Security: Add to a threat list on the NDR, not documented | |||
| Google Security Operations3 of 4 documented | Google Security Operations: Add to a threat list on the NDR, not documented | |||
| Splunk SOAR (Cisco)3 of 4 documented | Splunk SOAR (Cisco): Add to a threat list on the NDR, not documented | |||
| Swimlane3 of 4 documented | Swimlane: Add to a threat list on the NDR, not documented | |||
| Tines3 of 4 documented | Tines: Disable a switch port or NAC quarantine, not documented | |||
| BlinkOps2 of 4 documented, not ranked | BlinkOps: Disable a switch port or NAC quarantine, not documented | BlinkOps: Add to a threat list on the NDR, not documented | ||
| Exabeam2 of 4 documented, not ranked | Exabeam: Disable a switch port or NAC quarantine, not documented | Exabeam: Add to a threat list on the NDR, not documented | ||
| Palo Alto Cortex XSOAR2 of 4 documented | Palo Alto Cortex XSOAR: Disable a switch port or NAC quarantine, not documented | Palo Alto Cortex XSOAR: Add to a threat list on the NDR, not documented | ||
| ThreatConnect2 of 4 documented, not ranked | ThreatConnect: Disable a switch port or NAC quarantine, not documented | ThreatConnect: Add to a threat list on the NDR, not documented | ||
| Torq1 of 4 documented | Torq: Block IP or domain at the firewall, not documented | Torq: Disable a switch port or NAC quarantine, not documented | Torq: Add to a threat list on the NDR, not documented | |
| CrowdStrike Falcon Fusion SOAR0 of 4 documented, docs behind login | CrowdStrike Falcon Fusion SOAR: Block IP or domain at the firewall, not documented | CrowdStrike Falcon Fusion SOAR: Block at the proxy or DNS filter, not documented | CrowdStrike Falcon Fusion SOAR: Disable a switch port or NAC quarantine, not documented | CrowdStrike Falcon Fusion SOAR: Add to a threat list on the NDR, not documented |
| Dropzone AI0 of 4 documented | Dropzone AI: Block IP or domain at the firewall, not documented | Dropzone AI: Block at the proxy or DNS filter, not documented | Dropzone AI: Disable a switch port or NAC quarantine, not documented | Dropzone AI: Add to a threat list on the NDR, not documented |
| Mate Security0 of 4 documented | Mate Security: Block IP or domain at the firewall, not documented | Mate Security: Block at the proxy or DNS filter, not documented | Mate Security: Disable a switch port or NAC quarantine, not documented | Mate Security: Add to a threat list on the NDR, not documented |
| Microsoft Sentinel0 of 4 documented | Microsoft Sentinel: Block IP or domain at the firewall, not documented | Microsoft Sentinel: Block at the proxy or DNS filter, not documented | Microsoft Sentinel: Disable a switch port or NAC quarantine, not documented | Microsoft Sentinel: Add to a threat list on the NDR, not documented |
| Prophet Security0 of 4 documented | Prophet Security: Block IP or domain at the firewall, not documented | Prophet Security: Block at the proxy or DNS filter, not documented | Prophet Security: Disable a switch port or NAC quarantine, not documented | Prophet Security: Add to a threat list on the NDR, not documented |
| Revelstoke (Arctic Wolf)0 of 4 documented, not ranked | Revelstoke (Arctic Wolf): Block IP or domain at the firewall, not documented | Revelstoke (Arctic Wolf): Block at the proxy or DNS filter, not documented | Revelstoke (Arctic Wolf): Disable a switch port or NAC quarantine, not documented | Revelstoke (Arctic Wolf): Add to a threat list on the NDR, not documented |
| ServiceNow Security Operations0 of 4 documented | ServiceNow Security Operations: Block IP or domain at the firewall, not documented | ServiceNow Security Operations: Block at the proxy or DNS filter, not documented | ServiceNow Security Operations: Disable a switch port or NAC quarantine, not documented | ServiceNow Security Operations: Add to a threat list on the NDR, not documented |
10of 18 document it
Block IP or domain at the firewall
Add an IP address, FQDN or URL to a firewall blocklist, address group or deny rule.
Typical targets: Palo Alto Networks PAN-OS and Panorama, Fortinet FortiGate, Check Point, Cisco Firepower.
- Cyware, native: Fortinet FortiGate Firewall: Ban IP; Palo Alto Firewall: Add Address Object to Address Group. techdocs.cyware.com, read
- D3 Security, native: Palo Alto Networks PAN-OS: Block Domains By Adding To Address Group; Fortinet FortiGate: Remove IPs From Address Group and ban commands. docs.d3security.com, read
- Google Security Operations, native: Palo Alto Panorama: Block IPs in Policy; FortiGate: Add Entities To Address Group. cloud.google.com, read
- Splunk SOAR (Cisco), native: Palo Alto Networks Panorama: block ip; Fortinet FortiGate: block ip. github.com, read
- Swimlane, native: Palo Alto Networks PAN-OS: Create a Security Policy Rule; Fortinet FortiGate: Create Policy; Zscaler Security: Add Firewall Filtering Policy Rule. docs.swimlane.com, read
- Tines, native: AWS WAF: Update an IPSet template. tines.com, read
- BlinkOps, native: Fortinet FortiGate: Add Address, Append Address to Group. docs.blinkops.com, read
- Exabeam, native: Palo Alto Networks Firewall service: block and unblock IP addresses and URLs; Fortinet service: block and unblock IP addresses. docs.exabeam.com, read
- Palo Alto Cortex XSOAR, native: Fortinet FortiGate: fortigate-ban-ip; Palo Alto Networks PAN-OS: pan-os-register-ip-tag, address group commands. github.com, read
- ThreatConnect, native: Palo Alto Networks NGFW: deploy Address and URL Indicators to NGFW or Panorama for alerting and blocking. knowledge.threatconnect.com, read
Not documented on the pages read (8): Torq, CrowdStrike Falcon Fusion SOAR, Dropzone AI, Mate Security, Microsoft Sentinel, Prophet Security, Revelstoke (Arctic Wolf), ServiceNow Security Operations.
11of 18 document it
Block at the proxy or DNS filter
Add a URL or domain to a secure web gateway denylist or DNS filter block list.
Typical targets: Zscaler Internet Access, Cisco Umbrella, Netskope, Cloudflare Gateway.
- Cyware, native: Zscaler Secure Internet Access: Add URLs to Blocklist. techdocs.cyware.com, read
- D3 Security, native: Zscaler: Blacklist URLs; Cisco Umbrella Enforcement: Delete Enforced Domains and enforcement commands. docs.d3security.com, read
- Google Security Operations, native: Zscaler: Add to Blacklist; Cisco Umbrella: Add Domain. cloud.google.com, read
- Splunk SOAR (Cisco), native: Zscaler: block url, block ip; Cisco Umbrella: block domain. github.com, read
- Swimlane, native: Zscaler Security: Block URLs; Cisco Umbrella: Add Destinations to Destination List. docs.swimlane.com, read
- Tines, native: Cisco Umbrella: Block Domain template; Zscaler: Add Black-Listed URLs template. tines.com, read
- BlinkOps, native: Zscaler Internet Access: Update Denylist URLs, Denylist Action. docs.blinkops.com, read
- Exabeam, native: Cisco Umbrella Enforcement service: block malicious or suspicious domains; Zscaler service: manage blacklists. docs.exabeam.com, read
- Palo Alto Cortex XSOAR, native: Zscaler Internet Access: zscaler-blacklist-url, zscaler-blacklist-ip. github.com, read
- ThreatConnect, native: Zscaler Internet Access content pack: Add URL or Host to ZIA Blocked Malicious URLs; Cisco Umbrella: add and remove Host and URL Indicators. knowledge.threatconnect.com, read
- Torq, native: Zscaler: Add and Remove URLs from the Global Blacklist template; Cloudflare Zero Trust: Add Phishing Domain template. kb.torq.io, read
Not documented on the pages read (7): CrowdStrike Falcon Fusion SOAR, Dropzone AI, Mate Security, Microsoft Sentinel, Prophet Security, Revelstoke (Arctic Wolf), ServiceNow Security Operations.
4of 18 document it
Disable a switch port or NAC quarantine
Quarantine an endpoint through network access control, or disable its switch port, so it loses network access.
Typical targets: Cisco ISE, Aruba ClearPass, Forescout, Cisco Meraki.
- D3 Security, native: Cisco ISE: Assign Endpoints to Blacklist. docs.d3security.com, read
- Google Security Operations, native: Cisco ISE: Quarantine Address. cloud.google.com, read
- Splunk SOAR (Cisco), native: Cisco ISE: apply policy (ANC quarantine), terminate session. github.com, read
- Swimlane, native: Cisco Identity Services Engine: Change of Authorization Session Disconnect. docs.swimlane.com, read
Not documented on the pages read (14): Cyware, Tines, BlinkOps, Exabeam, Palo Alto Cortex XSOAR, ThreatConnect, Torq, CrowdStrike Falcon Fusion SOAR, Dropzone AI, Mate Security, Microsoft Sentinel, Prophet Security, Revelstoke (Arctic Wolf), ServiceNow Security Operations.
2of 18 document it
Add to a threat list on the NDR
Add an indicator or entity to a watchlist, blocklist or intel feed on a network detection and response tool.
Typical targets: Darktrace, Vectra, ExtraHop Reveal(x), Cisco Secure Cloud Analytics.
- Cyware, native: Darktrace: Add Domain to Intel Feed, Add IPs to Intel Feed. techdocs.cyware.com, read
- Tines, native: Cisco Secure Cloud Analytics: Create Watchlisted Domain template. tines.com, read
Not documented on the pages read (16): D3 Security, Google Security Operations, Splunk SOAR (Cisco), Swimlane, BlinkOps, Exabeam, Palo Alto Cortex XSOAR, ThreatConnect, Torq, CrowdStrike Falcon Fusion SOAR, Dropzone AI, Mate Security, Microsoft Sentinel, Prophet Security, Revelstoke (Arctic Wolf), ServiceNow Security Operations.