https://community.cisco.com/t5/network-security/correlation-events/m-p/3864743#M17631 <P>Is it possible to setup a correlation event that will temporarily blacklist an IP address based on receiving a # of intrusion events against a destination IP?</P><P>&nbsp;</P><P>Or is there another way in the FP to do something like this?&nbsp; The appliance is sitting inline.</P> Wed, 29 May 2019 21:02:32 GMT rsharp001 2019-05-29T21:02:32Z https://community.cisco.com/t5/network-security/correlation-events/m-p/3864743#M17631 <P>Is it possible to setup a correlation event that will temporarily blacklist an IP address based on receiving a # of intrusion events against a destination IP?</P><P>&nbsp;</P><P>Or is there another way in the FP to do something like this?&nbsp; The appliance is sitting inline.</P> Wed, 29 May 2019 21:02:32 GMT https://community.cisco.com/t5/network-security/correlation-events/m-p/3864743#M17631 rsharp001 2019-05-29T21:02:32Z https://community.cisco.com/t5/network-security/correlation-events/m-p/3865255#M17632 <P>Adding more information:</P><P>- This is a physical appliance, not an ASA running FTD, running 6.3.0.&nbsp; It is inline.&nbsp;</P><P>- What I'm wanting to do is have the box auto blacklist and remove from that list(if possible from correlation events) any IPs that are blocked multiple times over a period of time.</P> Thu, 30 May 2019 16:24:55 GMT https://community.cisco.com/t5/network-security/correlation-events/m-p/3865255#M17632 rsharp001 2019-05-30T16:24:55Z