It blocks it if you click on the "mark as malicious" but you have to monitor the dashboard to pick up on these at the time. Once the rogue leaves you can no longer do that. But then the threat has gone as well so sort of solved itself!
The extra line "mark as malicious" only appears during the threat lifetime.
It's simple but not particularly user friendly.