Abstract: A method, device and assembly are disclosed herein. Each of the method, device and assembly, in an embodiment, is operable to perform multiple steps for protecting a network, including adding resources to a blocklist if the resources satisfy a blockage condition. After a maturation period expires, the steps include determining whether the blocked resource is listed on a blacklist. The addition to the blocklist corresponds to a precautionary event, and the presence on the blacklist corresponds to a threat event. The steps include determining a correlation of the precautionary events to the threat events, and changing or adjusting the blockage condition as a result of the correlation outcome differing from a correlation target factor by a designated amount.