IP (source) block
not groups (as a country) or range. But a single address that is attacking the UTM.
(already present?) in one clear list. blocked GEO's or ranges. Temperal bans from the firewall by detected attacks. and the manual blocked ip.s
When blocking the ip (or small range) chance to select: 30 min, 1 hour, 1 dag, 1 month, for ever.