There is not currently the "button" approach.
But I have passed the request on to our Marketing managers so they can consider it in the future.
In the mean time here is an alternative you might try. I have not tested this myself, but I believe it will work:
Enter the signature configuration mode in the CLI:
"service signature-definition sig0"
Now create a variable containing the list of addresses that you want denied:
"variables DENYIP ip-addr-range 1.1.1.1,10.2.2.2,30.3.3.3"
Now create a simple signature that matches any packets with a source IP address in that variable, and set the event action to deny-attacker-inline:
==============================
signatures 61000 0
alert-severity high
sig-description
sig-name My Manual Deny Attacker Signature
sig-string-info Used to manually deny an address
exit
engine atomic-ip
event-action deny-attacker-inline
specify-ip-addr-options yes
ip-addr-options ip-addr
specify-src-ip-addr yes
src-ip-addr $DENYIP
exit
exit
exit
exit
alert-frequency
summary-mode fire-once
exit
exit
exit
=========================================
When applied that new sig 61000 should deny all of the IPs in your DENYIP variable.
To deny a new IP all you have to do is add it to the variable, and apply the change.
The signature will automatically start denying the new address.
If you like the GUI approach you can use IDM to modify the "DENYIP" variable.
So what happens when I no longer want that IP Denied?
Using IDM you first remove it from the "DENYIP" variable, and apply the config change (this will prevent the signature from adding new deny requests for that IP)
Then go to the Monitoring Tab and select the "Clear List" button.
BUT BE CAREFULL. The "Clear List" will clear out the list of ALL Denied Attackers. Any Denied Attacker that was done because of a signature trigger will be removed, and will only be re-added if the attacker triggers the signature again.
HOWEVER, any IP in your DENYIP variable will be added automatically back in to the Deny List just as soon as the first packet is seen from that IP.
Now I have not tried this myself, but I am 98% sure it will function correctly.
And this may or may not work for what you are attempting to do.
