We are examining how to add this as a new automation to Horizon Playblocks.
It already includes automations to block attacks and scans such as:
Block common scanner identified by IPS
The automation blocks scanners across the organization and is triggered by scans that are detected by IPS with very high confidence. The block can be automatic, or upon admin's approval. The notification includes information on the scan and the scanner. More parameters can be set using the automation parameters such as the block duration, whether the block is automatic or upon admins' approval, and more.
https://www.checkpoint.com/horizon/playblocks/
