IF FOE

If foe… Add to the block list recommendations for the next change review or window Check for additional attackers/symptoms on the same CIDR block Block at the firewall or IPS as appropriate (Class C CIDR block or smaller) Note date of block, and add to an expire/review list for 30 days Note and review country of origin for appropriateness to the business