Block IP addresses for an incident (Northstar)
Use this procedure to block IP addresses for a selected incident.
Steps
From the left navigation, select Incidents.
Select an incident.
In the Containment actions section, select Block IP.
Select the IP address you want to block.
Select a time period for how long you want to block the IP address.
Select Never if you want want to keep the blocking in effect without expiration.
Block or allow IPs provides additional details about the IP denylist.