You can create blocked list rules directly from the description of an email messages captured as an security event.
To create a blocked list rule from an email message
Navigate to either the Dashboard or Events page.
Click on the link for the email message from which you want to create a blocked list rule.
Under the Security Stack section, in the Anti Phishing block, click Create Blocked-List rule. The Mark emails as clean dialog displays.
Select the fields and associated values you want assigned to the new blocked list rule. The list at the bottom of the dialog will dynamically update to display all of the messages that would be affected by the settings in your new blocked list rule.