Security Operations Integration - Block Request capability

The Block Action capability blocks observables associated with a security incident on a firewall, web proxy, or other control point using implementation workflows. This capability is used during incident response investigations to contain an identified threat.

The Block Request capability has a workflow, Security Operations Integration - Block Request workflow, that executes the request to block. This workflow accepts a list of observables, finds any implementing capabilities, and executes the request based on the configured workflow.

Note: If no implementations are available, capability actions are not displayed in product menus.