While fine-tuning Aggressive Aging in a customer configuration, we've found that the Aggresive Aging IPS signature includes a parameter name "add souce IP to quarantine list".
The thing is that there are no details about this parameter. Is it a permanent block? Only for x seconds/minutes/hours? Is it configurable? Does it use SAM?
Does anyone know a bit more about this?