Correlation Events

[rsharp001]

Is it possible to setup a correlation event that will temporarily blacklist an IP address based on receiving a # of intrusion events against a destination IP?

Or is there another way in the FP to do something like this?  The appliance is sitting inline.

[rsharp001]

Adding more information:

- This is a physical appliance, not an ASA running FTD, running 6.3.0.  It is inline. 

- What I'm wanting to do is have the box auto blacklist and remove from that list(if possible from correlation events) any IPs that are blocked multiple times over a period of time.