Do your SoC Analysts insist on blacklisting things?

Nearly everyday, our SoC guys request we manually add a domain or sender to the email blacklist, or blacklist some IP.

To me, this is giant waste of time. Am I wrong?