The fastest Falcon Platform action to stop active data exfiltration from a known endpoint is network containment. Containing Bob-Desktop from the Falcon console restricts network communication while preserving Falcon sensor connectivity for investigation and response. This is better than trying to create an IOA or IOC for a specific destination IP because the adversary may change infrastructure, use multiple destinations, or already have active sessions. Accessing the host through RTR can support follow-up investigation, but the immediate containment action should be initiated from the Falcon console. The objective is not just to detect future traffic; it is to stop current outbound communication.
Network containment is the direct responder action for isolating a host involved in suspected exfiltration.

When pre-staging a Custom IOC for later use, the correct action is No Action because the responder wants to save the hash without immediately generating detections or enforcing a block. This is useful when an indicator is being prepared for approval, validation, or future activation. "Always Block" would actively prevent execution and should only be used when the hash is confirmed malicious and ready for enforcement. "Monitor" would generate visibility, but that is still an active detection posture rather than a passive staged state. "Save Hash" is not the correct Falcon IOC action. In Falcon Responder workflows, choosing the correct IOC action matters because a premature block or detection can disrupt operations or create unnecessary alert volume.