This would actually be a nice to have at the MSP level also. An unwanted rule would allow the IR team to add a known bad IP or IP range to the unwanted list and quickly find any other Identities that might have been compromised.