Response to intrusion attempts

Hi there.

I would please like to know if anyone has a policy or some guidelines for responding to intrusion attempts?

Our intrusion detection engine can pick up and optionally block intruders, but what action (if any) should we take afterwards?

TIA
– Godfrey