For example, you are using Snort and you just got a serious event, which states that a certain service is attacked.
What do you do with the threat source IP?
What are the steps that network event analyst performs?
Edit: Narrowing the question down, how it is dealt with such threats, instantly block ip? Gather evidence? Reroute the traffic for further analysis? I just need some behavior examples on example situations.
Edit2: Specifically, DoS/DDoS attacks.