By popular demand we added a block IP function. You can click on the 
icon from either the real time or historical interface. After you enter an IP address, it will be immediately blocked (if you have enabled the isolate function by clicking on the isolate checkbox in the sensor configuration). This action creates a block classification automatically. You can later delete it or modify it by edit the block classification.
The blocking occurs by injecting spoofed TCP RST and other packets to disrupt communications for the blocked IP.