Add suspicious IP addresses or FQDNs to a Container directly from the story drill-down page, and then include them in your firewall rules.